test(acceptance): beoordeling scenario asserts the workflow task is completed (refs #13)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yaml

@@ -157,7 +157,7 @@ jobs:
       # Log dump must precede teardown (which removes the containers).
       - name: Dump container logs on failure
         if: failure()
-        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-db flowable-rest flowable-init keycloak acl bff domain projection-db event-subscriber projection-api self-service openbaar behandel 2>&1 || true
+        run: docker compose -f infra/docker-compose.yml logs --no-color --tail=100 oz-init openzaak nrc-init nrc-web nrc-celery nrc-beat flowable-db flowable-rest flowable-init keycloak acl bff domain projection-db event-subscriber projection-api self-service 2>&1 || true
       - name: Tear down
         if: always()
         run: make down

Makefile

@@ -10,7 +10,7 @@ COMPOSE    := infra/docker-compose.yml
 # Long-running services with a healthcheck — the smoke polls these for readiness
 # (infra/wait-healthy.sh). One-shot init jobs (oz-init, nrc-init, flowable-init)
 # are not polled; they only need to have run. See docs/runbooks/gitea-actions-gotchas.md.
-WAIT_SVCS  := openzaak nrc-web acl bff domain event-subscriber projection-api self-service openbaar behandel
+WAIT_SVCS  := openzaak nrc-web acl bff domain event-subscriber projection-api self-service openbaar
 # Config files (OpenZaak data.yaml, Keycloak realms, Flowable BPMN) are streamed
 # into external named volumes via `docker cp` (infra/seed-config.sh) instead of
 # bind-mounted, because bind mounts don't reach sibling containers on the

apps/behandel/Dockerfile

@@ -1,27 +0,0 @@
-# Multi-stage build for the behandel portal (Angular → nginx).
-# Build context is the repo root (the app needs the pnpm workspace + libs). See infra/docker-compose.yml.
-FROM node:24-slim AS build
-WORKDIR /src
-RUN corepack enable && corepack prepare pnpm@11.5.2 --activate
-
-# Restore first (cached unless the manifests change).
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml nx.json tsconfig.base.json eslint.config.mjs ./
-RUN pnpm install --frozen-lockfile
-
-# Sources (only what the app + its libs need).
-COPY apps/behandel apps/behandel
-COPY libs libs
-RUN pnpm nx build behandel
-
-FROM nginx:1.27-alpine AS runtime
-COPY apps/behandel/nginx.conf /etc/nginx/conf.d/default.conf
-COPY --from=build /src/dist/apps/behandel/browser /usr/share/nginx/html
-# Compose-time OIDC config: the browser (Playwright, on the compose network) reaches Keycloak by
-# service name, so the token issuer matches the BFF's medewerker authority (host-consistent, ADR-0013).
-RUN printf '{ "authority": "http://keycloak:8080/realms/medewerker" }\n' > /usr/share/nginx/html/config.json
-# Make the reverse-proxy resolver engine-portable (Docker 127.0.0.11 vs podman aardvark); runs from
-# the nginx image's /docker-entrypoint.d before nginx starts.
-COPY apps/portal-nginx-resolver.sh /docker-entrypoint.d/40-resolver.sh
-RUN chmod +x /docker-entrypoint.d/40-resolver.sh
-
-EXPOSE 80

apps/behandel/eslint.config.mjs

@@ -1,34 +0,0 @@
-import nx from '@nx/eslint-plugin';
-import baseConfig from '../../eslint.config.mjs';
-
-export default [
-  ...nx.configs['flat/angular'],
-  ...nx.configs['flat/angular-template'],
-  ...baseConfig,
-  {
-    files: ['**/*.ts'],
-    rules: {
-      '@angular-eslint/directive-selector': [
-        'error',
-        {
-          type: 'attribute',
-          prefix: 'app',
-          style: 'camelCase',
-        },
-      ],
-      '@angular-eslint/component-selector': [
-        'error',
-        {
-          type: 'element',
-          prefix: 'app',
-          style: 'kebab-case',
-        },
-      ],
-    },
-  },
-  {
-    files: ['**/*.html'],
-    // Override or add rules here
-    rules: {},
-  },
-];

apps/behandel/nginx.conf

@@ -1,24 +0,0 @@
-server {
-  listen 80;
-  server_name _;
-  root /usr/share/nginx/html;
-  index index.html;
-
-  # Resolve the BFF via Docker's embedded DNS at request time (variable proxy_pass), so nginx starts
-  # even before the BFF is up and picks up restarts — instead of failing to load the config.
-  resolver 127.0.0.11 ipv6=off valid=30s;
-
-  # Same-origin API: proxy the behandel endpoint group to the bff service. The api-client uses
-  # relative URLs, so the browser calls this origin and nginx forwards to the BFF — no CORS, and the
-  # medewerker token (same-origin) is attached by the app's interceptor (ADR-0013).
-  location /behandel/ {
-    set $bff http://bff:8080;
-    proxy_pass $bff;
-    proxy_set_header Host $host;
-  }
-
-  # SPA fallback — Angular client-side routing.
-  location / {
-    try_files $uri $uri/ /index.html;
-  }
-}

apps/behandel/project.json

@@ -1,80 +0,0 @@
-{
-  "name": "behandel",
-  "$schema": "../../node_modules/nx/schemas/project-schema.json",
-  "projectType": "application",
-  "prefix": "app",
-  "sourceRoot": "apps/behandel/src",
-  "tags": [],
-  "targets": {
-    "build": {
-      "executor": "@angular/build:application",
-      "outputs": ["{options.outputPath}"],
-      "defaultConfiguration": "production",
-      "options": {
-        "outputPath": "dist/apps/behandel",
-        "browser": "apps/behandel/src/main.ts",
-        "tsConfig": "apps/behandel/tsconfig.app.json",
-        "assets": [
-          {
-            "glob": "**/*",
-            "input": "apps/behandel/public"
-          }
-        ],
-        "styles": ["apps/behandel/src/styles.css"]
-      },
-      "configurations": {
-        "production": {
-          "budgets": [
-            {
-              "type": "initial",
-              "maximumWarning": "1mb",
-              "maximumError": "2mb"
-            },
-            {
-              "type": "anyComponentStyle",
-              "maximumWarning": "4kb",
-              "maximumError": "8kb"
-            }
-          ],
-          "outputHashing": "all"
-        },
-        "development": {
-          "optimization": false,
-          "extractLicenses": false,
-          "sourceMap": true
-        }
-      }
-    },
-    "serve": {
-      "continuous": true,
-      "executor": "@angular/build:dev-server",
-      "defaultConfiguration": "development",
-      "configurations": {
-        "production": {
-          "buildTarget": "behandel:build:production"
-        },
-        "development": {
-          "buildTarget": "behandel:build:development"
-        }
-      }
-    },
-    "lint": {
-      "executor": "@nx/eslint:lint"
-    },
-    "test": {
-      "executor": "@angular/build:unit-test",
-      "options": {
-        "watch": false
-      }
-    },
-    "serve-static": {
-      "continuous": true,
-      "executor": "@nx/web:file-server",
-      "options": {
-        "buildTarget": "behandel:build",
-        "staticFilePath": "dist/apps/behandel/browser",
-        "spa": true
-      }
-    }
-  }
-}

apps/behandel/public/config.json

@@ -1,3 +0,0 @@
-{
-  "authority": "http://localhost:8180/realms/medewerker"
-}

apps/behandel/src/app/app.config.spec.ts

@@ -1,73 +0,0 @@
-import { provideHttpClient, withInterceptors } from '@angular/common/http';
-import { HttpTestingController, provideHttpClientTesting } from '@angular/common/http/testing';
-import { TestBed } from '@angular/core/testing';
-import { BffApiV1Service } from 'api-client';
-import { authInterceptor } from 'auth';
-import { AbstractSecurityStorage, ConfigurationService } from 'angular-auth-oidc-client';
-import { SECURE_API_ROUTES } from './app.config';
-
-// Guards the medewerker token wiring end-to-end. The api-client calls the BFF with RELATIVE URLs, and
-// the angular-auth-oidc-client interceptor attaches the token only when `req.url` starts with a
-// configured secureRoute. A regression to an absolute origin makes the relative URL never match, so
-// the behandel calls go out unauthenticated and the BFF answers 401. This drives the REAL interceptor
-// and the REAL api-client against the REAL production route value (SECURE_API_ROUTES); only the config
-// source and token storage are faked, so the assertion turns on the actual route-matching.
-describe('behandel medewerker token wiring', () => {
-  let http: HttpTestingController;
-  let bff: BffApiV1Service;
-  const token = 'medewerker-access-token';
-
-  beforeEach(() => {
-    TestBed.configureTestingModule({
-      providers: [
-        provideHttpClient(withInterceptors([authInterceptor()])),
-        provideHttpClientTesting(),
-        {
-          provide: ConfigurationService,
-          useValue: {
-            hasAtLeastOneConfig: () => true,
-            getAllConfigurations: () => [{ configId: 'medewerker', secureRoutes: SECURE_API_ROUTES }],
-          },
-        },
-        {
-          // A signed-in session: the storage the interceptor's token lookup reads from.
-          provide: AbstractSecurityStorage,
-          useValue: {
-            read: () => JSON.stringify({ authzData: token, authnResult: { id_token: 'id-token' } }),
-            write: () => undefined,
-            remove: () => undefined,
-            clear: () => undefined,
-          },
-        },
-      ],
-    });
-    http = TestBed.inject(HttpTestingController);
-    bff = TestBed.inject(BffApiV1Service);
-  });
-
-  afterEach(() => http.verify());
-
-  it('attaches the bearer token to the relative werkbak call', () => {
-    bff.getBehandelWerkbak().subscribe();
-
-    const req = http.expectOne('/behandel/werkbak');
-    expect(req.request.headers.get('Authorization')).toBe(`Bearer ${token}`);
-    req.flush([]);
-  });
-
-  it('attaches the bearer token to the relative decide call', () => {
-    bff.postBehandelRegistrationsIdDecide('reg-1', { besluit: 'goedkeuren' }).subscribe();
-
-    const req = http.expectOne('/behandel/registrations/reg-1/decide');
-    expect(req.request.headers.get('Authorization')).toBe(`Bearer ${token}`);
-    req.flush(null);
-  });
-
-  it('leaves the anonymous openbaar register call unauthenticated', () => {
-    bff.getOpenbaarRegister().subscribe();
-
-    const req = http.expectOne((r) => r.url === '/openbaar/register');
-    expect(req.request.headers.has('Authorization')).toBe(false);
-    req.flush([]);
-  });
-});

apps/behandel/src/app/app.config.ts

@@ -1,39 +0,0 @@
-import { provideHttpClient, withInterceptors } from '@angular/common/http';
-import { ApplicationConfig, provideBrowserGlobalErrorListeners } from '@angular/core';
-import { provideRouter } from '@angular/router';
-import { authInterceptor, provideMedewerkerAuth } from 'auth';
-import { appRoutes } from './app.routes';
-
-/** Environment-specific settings fetched from /config.json at startup (see main.ts). */
-export interface RuntimeConfig {
-  /** The Keycloak `medewerker` realm issuer as the browser reaches it (dev: localhost; compose: keycloak:8080). */
-  authority: string;
-}
-
-/**
- * Route prefixes whose requests carry the medewerker token. These MUST match the **relative** URLs
- * the api-client actually calls (same-origin via the nginx proxy) — the interceptor matches on
- * `req.url`, which stays relative, so an absolute origin would never match and the token would go
- * unattached. Only `/behandel/` is secured; the app calls no other endpoint group.
- */
-export const SECURE_API_ROUTES = ['/behandel/'];
-
-/**
- * Build the app providers from runtime config. `redirectUrl` is the app's own origin (where Keycloak
- * redirects back). `secureRoutes` uses {@link SECURE_API_ROUTES} — relative prefixes, not the origin.
- */
-export function appConfig(runtime: RuntimeConfig): ApplicationConfig {
-  const origin = typeof window !== 'undefined' ? window.location.origin : '/';
-  return {
-    providers: [
-      provideBrowserGlobalErrorListeners(),
-      provideRouter(appRoutes),
-      provideHttpClient(withInterceptors([authInterceptor()])),
-      provideMedewerkerAuth({
-        authority: runtime.authority,
-        redirectUrl: origin,
-        secureRoutes: SECURE_API_ROUTES,
-      }),
-    ],
-  };
-}

apps/behandel/src/app/app.html

@@ -1 +0,0 @@
-<router-outlet></router-outlet>

apps/behandel/src/app/app.routes.ts

@@ -1,7 +0,0 @@
-import { Route } from '@angular/router';
-import { authenticatedGuard } from 'auth';
-import { WerkbakPage } from './werkbak/werkbak-page';
-
-export const appRoutes: Route[] = [
-  { path: '', component: WerkbakPage, canActivate: [authenticatedGuard] },
-];

apps/behandel/src/app/app.spec.ts

@@ -1,15 +0,0 @@
-import { provideRouter } from '@angular/router';
-import { render, screen } from '@testing-library/angular';
-import { App } from './app';
-
-describe('App', () => {
-  it('renders the router outlet shell', async () => {
-    const { container } = await render(App, {
-      providers: [provideRouter([])],
-    });
-
-    // The shell is a thin host for routed pages (the WerkbakPage owns the heading).
-    expect(container.querySelector('router-outlet')).toBeTruthy();
-    expect(screen).toBeTruthy();
-  });
-});

apps/behandel/src/app/app.ts

@@ -1,12 +0,0 @@
-import { Component } from '@angular/core';
-import { RouterModule } from '@angular/router';
-
-@Component({
-  imports: [RouterModule],
-  selector: 'app-root',
-  templateUrl: './app.html',
-  styleUrl: './app.css',
-})
-export class App {
-  protected title = 'behandel';
-}

apps/behandel/src/app/werkbak/werkbak-page.html

@@ -1,64 +0,0 @@
-<main utrecht-document class="utrecht-theme">
-  <utrecht-article>
-    <utrecht-heading-1>Werkbak</utrecht-heading-1>
-    <p utrecht-paragraph>
-      Registraties die wachten op beoordeling. Keur elke registratie goed of wijs deze af.
-    </p>
-
-    @if (loading()) {
-      <p utrecht-paragraph role="status">Bezig met laden…</p>
-    } @else if (failed()) {
-      <p utrecht-paragraph role="alert">
-        Kon de werkbak niet laden. Controleer of je als behandelaar bent ingelogd en probeer het
-        opnieuw.
-      </p>
-    } @else if (loaded() && items().length === 0) {
-      <p utrecht-paragraph role="status">De werkbak is leeg.</p>
-    } @else if (items().length > 0) {
-      <table utrecht-table>
-        <caption>
-          Registraties in behandeling
-        </caption>
-        <thead>
-          <tr>
-            <th scope="col">Referentie</th>
-            <th scope="col">BSN</th>
-            <th scope="col">Status</th>
-            <th scope="col">Actie</th>
-          </tr>
-        </thead>
-        <tbody>
-          @for (item of items(); track item.registrationId) {
-            <tr>
-              <td>{{ item.registrationId }}</td>
-              <td>{{ item.bsn }}</td>
-              <td>{{ item.status }}</td>
-              <td>
-                <button
-                  utrecht-button
-                  appearance="primary-action-button"
-                  type="button"
-                  [attr.aria-label]="'Goedkeuren ' + item.registrationId"
-                  [disabled]="deciding() === item.registrationId"
-                  (click)="decide(item.registrationId, 'goedkeuren')"
-                >
-                  Goedkeuren
-                </button>
-                <button
-                  utrecht-button
-                  appearance="secondary-action-button"
-                  type="button"
-                  [attr.aria-label]="'Afwijzen ' + item.registrationId"
-                  [disabled]="deciding() === item.registrationId"
-                  (click)="decide(item.registrationId, 'afwijzen')"
-                >
-                  Afwijzen
-                </button>
-              </td>
-            </tr>
-          }
-        </tbody>
-      </table>
-    }
-  </utrecht-article>
-</main>

apps/behandel/src/app/werkbak/werkbak-page.spec.ts

@@ -1,110 +0,0 @@
-import { signal } from '@angular/core';
-import { fireEvent, render, screen } from '@testing-library/angular';
-import { of, throwError } from 'rxjs';
-import { BffApiV1Service, type WerkbakItem } from 'api-client';
-import { AuthService } from 'auth';
-import { axe } from 'vitest-axe';
-import { WerkbakPage } from './werkbak-page';
-
-const sample: WerkbakItem[] = [
-  { registrationId: 'reg-1', bsn: '123456782', status: 'InBehandeling' },
-  { registrationId: 'reg-2', bsn: '111222333', status: 'InBehandeling' },
-];
-
-class FakeAuth extends AuthService {
-  readonly isAuthenticated = signal(true);
-  readonly bsn = signal<string | undefined>(undefined);
-  override readonly roles = signal<readonly string[]>(['behandelaar']);
-  login(): void {
-    /* not exercised here */
-  }
-  logout(): void {
-    /* spied in tests */
-  }
-}
-
-function setup(
-  overrides: {
-    getBehandelWerkbak?: ReturnType<typeof vi.fn>;
-    postBehandelRegistrationsIdDecide?: ReturnType<typeof vi.fn>;
-  } = {},
-) {
-  const getBehandelWerkbak =
-    overrides.getBehandelWerkbak ?? vi.fn().mockReturnValue(of(sample));
-  const postBehandelRegistrationsIdDecide =
-    overrides.postBehandelRegistrationsIdDecide ?? vi.fn().mockReturnValue(of(undefined));
-  return {
-    getBehandelWerkbak,
-    postBehandelRegistrationsIdDecide,
-    providers: [
-      {
-        provide: BffApiV1Service,
-        useValue: { getBehandelWerkbak, postBehandelRegistrationsIdDecide },
-      },
-      { provide: AuthService, useClass: FakeAuth },
-    ],
-  };
-}
-
-describe('WerkbakPage', () => {
-  it('lists the registrations awaiting beoordeling on open', async () => {
-    const { getBehandelWerkbak, providers } = setup();
-    await render(WerkbakPage, { providers });
-
-    expect(getBehandelWerkbak).toHaveBeenCalled();
-    expect(await screen.findByText('reg-1')).toBeTruthy();
-    expect(screen.getByText('123456782')).toBeTruthy();
-    expect(screen.getByText('reg-2')).toBeTruthy();
-  });
-
-  it('approves a registration (goedkeuren) and refreshes the werkbak', async () => {
-    const { getBehandelWerkbak, postBehandelRegistrationsIdDecide, providers } = setup();
-    await render(WerkbakPage, { providers });
-
-    fireEvent.click((await screen.findAllByRole('button', { name: /goedkeuren/i }))[0]);
-
-    expect(postBehandelRegistrationsIdDecide).toHaveBeenCalledWith('reg-1', {
-      besluit: 'goedkeuren',
-    });
-    // Reloaded after the decision: once on open, once after deciding.
-    expect(getBehandelWerkbak).toHaveBeenCalledTimes(2);
-  });
-
-  it('rejects a registration (afwijzen) via the decide endpoint', async () => {
-    const { postBehandelRegistrationsIdDecide, providers } = setup();
-    await render(WerkbakPage, { providers });
-
-    fireEvent.click((await screen.findAllByRole('button', { name: /afwijzen/i }))[0]);
-
-    expect(postBehandelRegistrationsIdDecide).toHaveBeenCalledWith('reg-1', {
-      besluit: 'afwijzen',
-    });
-  });
-
-  it('shows an empty state when the werkbak has no items', async () => {
-    const { providers } = setup({ getBehandelWerkbak: vi.fn().mockReturnValue(of([])) });
-    await render(WerkbakPage, { providers });
-
-    expect(await screen.findByText(/werkbak is leeg/i)).toBeTruthy();
-  });
-
-  it('surfaces a load failure instead of swallowing it', async () => {
-    const { providers } = setup({
-      getBehandelWerkbak: vi.fn().mockReturnValue(throwError(() => new Error('403'))),
-    });
-    await render(WerkbakPage, { providers });
-
-    expect(await screen.findByText(/kon de werkbak niet laden/i)).toBeTruthy();
-  });
-
-  it('has no WCAG 2.1 AA violations', async () => {
-    document.documentElement.lang = 'nl';
-    const { container } = await render(WerkbakPage, { providers: setup().providers });
-
-    const results = await axe(container, {
-      runOnly: { type: 'tag', values: ['wcag2a', 'wcag2aa', 'wcag21a', 'wcag21aa'] },
-    });
-
-    expect(results.violations).toEqual([]);
-  });
-});

apps/behandel/src/app/werkbak/werkbak-page.ts

@@ -1,65 +0,0 @@
-import { Component, inject, signal } from '@angular/core';
-import { BffApiV1Service, type WerkbakItem } from 'api-client';
-import { UtrechtComponentsModule } from 'ui';
-
-/** The two decisions a behandelaar can make; the BFF validates these exact values (ADR-0013). */
-type Besluit = 'goedkeuren' | 'afwijzen';
-
-/**
- * The behandel werkbak: a signed-in behandelaar sees the registrations awaiting beoordeling (the open
- * Flowable `Beoordelen` tasks, read through the domain) and decides each — goedkeuren or afwijzen. A
- * decision posts to the BFF, which applies the domain transition and completes the workflow task
- * (ADR-0013; S-12). After a decision the werkbak refreshes so the handled item drops off the list.
- */
-@Component({
-  selector: 'app-werkbak-page',
-  imports: [UtrechtComponentsModule],
-  templateUrl: './werkbak-page.html',
-})
-export class WerkbakPage {
-  private readonly bff = inject(BffApiV1Service);
-
-  protected readonly items = signal<WerkbakItem[]>([]);
-  protected readonly loading = signal(false);
-  protected readonly loaded = signal(false);
-  protected readonly failed = signal(false);
-  protected readonly deciding = signal<string | undefined>(undefined);
-
-  constructor() {
-    this.load();
-  }
-
-  load(): void {
-    this.loading.set(true);
-    this.failed.set(false);
-    this.bff.getBehandelWerkbak().subscribe({
-      next: (rows: WerkbakItem[]) => {
-        this.items.set(rows);
-        this.loading.set(false);
-        this.loaded.set(true);
-      },
-      // Surface the failure (e.g. 403 for a non-behandelaar) instead of swallowing it.
-      error: () => {
-        this.items.set([]);
-        this.loading.set(false);
-        this.loaded.set(true);
-        this.failed.set(true);
-      },
-    });
-  }
-
-  decide(registrationId: string, besluit: Besluit): void {
-    this.deciding.set(registrationId);
-    this.bff.postBehandelRegistrationsIdDecide(registrationId, { besluit }).subscribe({
-      // Refresh so the decided registration drops off the werkbak (its task is now completed).
-      next: () => {
-        this.deciding.set(undefined);
-        this.load();
-      },
-      error: () => {
-        this.deciding.set(undefined);
-        this.failed.set(true);
-      },
-    });
-  }
-}

apps/behandel/src/index.html

@@ -1,13 +0,0 @@
-<!doctype html>
-<html lang="nl">
-  <head>
-    <meta charset="utf-8" />
-    <title>Behandelportaal BIG-register</title>
-    <base href="/" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <link rel="icon" type="image/x-icon" href="favicon.ico" />
-  </head>
-  <body>
-    <app-root></app-root>
-  </body>
-</html>

apps/behandel/src/main.ts

@@ -1,10 +0,0 @@
-import { bootstrapApplication } from '@angular/platform-browser';
-import { App } from './app/app';
-import { appConfig, type RuntimeConfig } from './app/app.config';
-
-// Load environment config before bootstrap so the OIDC authority is set per environment
-// (dev: localhost; compose: keycloak:8080) from a single build — 12-factor (S-08d).
-fetch('config.json')
-  .then((response) => response.json() as Promise<RuntimeConfig>)
-  .then((config) => bootstrapApplication(App, appConfig(config)))
-  .catch((err) => console.error(err));

apps/behandel/src/styles.css

@@ -1,2 +0,0 @@
-/* NL Design System theme — Utrecht design tokens (docs/frontend-decisions.md). */
-@import '@utrecht/design-tokens/dist/index.css';

apps/behandel/tsconfig.app.json

@@ -1,9 +0,0 @@
-{
-  "extends": "./tsconfig.json",
-  "compilerOptions": {
-    "outDir": "../../dist/out-tsc",
-    "types": []
-  },
-  "include": ["src/**/*.ts"],
-  "exclude": ["src/**/*.spec.ts", "src/**/*.test.ts"]
-}

apps/behandel/tsconfig.json

@@ -1,31 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "compilerOptions": {
-    "strict": true,
-    "noImplicitOverride": true,
-    "noPropertyAccessFromIndexSignature": true,
-    "noImplicitReturns": true,
-    "noFallthroughCasesInSwitch": true,
-    "isolatedModules": true,
-    "target": "es2022",
-    "moduleResolution": "bundler",
-    "emitDecoratorMetadata": false,
-    "module": "preserve"
-  },
-  "angularCompilerOptions": {
-    "enableI18nLegacyMessageIdFormat": false,
-    "strictInjectionParameters": true,
-    "strictInputAccessModifiers": true,
-    "strictTemplates": true
-  },
-  "files": [],
-  "include": [],
-  "references": [
-    {
-      "path": "./tsconfig.app.json"
-    },
-    {
-      "path": "./tsconfig.spec.json"
-    }
-  ]
-}

apps/behandel/tsconfig.spec.json

@@ -1,8 +0,0 @@
-{
-  "extends": "./tsconfig.json",
-  "compilerOptions": {
-    "outDir": "../../dist/out-tsc",
-    "types": ["vitest/globals"]
-  },
-  "include": ["src/**/*.ts", "src/**/*.d.ts"]
-}

apps/openbaar/Dockerfile

@@ -17,9 +17,5 @@ FROM nginx:1.27-alpine AS runtime
 COPY apps/openbaar/nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=build /src/dist/apps/openbaar/browser /usr/share/nginx/html
 # No runtime config: the openbaar register is anonymous (no OIDC authority to inject).
-# Make the reverse-proxy resolver engine-portable (Docker 127.0.0.11 vs podman aardvark); runs from
-# the nginx image's /docker-entrypoint.d before nginx starts.
-COPY apps/portal-nginx-resolver.sh /docker-entrypoint.d/40-resolver.sh
-RUN chmod +x /docker-entrypoint.d/40-resolver.sh
 
 EXPOSE 80

apps/portal-nginx-resolver.sh

@@ -1,17 +0,0 @@
-#!/bin/sh
-# Point nginx's reverse-proxy `resolver` at THIS container's real DNS server.
-#
-# The portal nginx configs use a variable proxy_pass, which needs a `resolver` so the BFF hostname is
-# resolved at request time (nginx can start before the BFF is up). The config hardcodes Docker's
-# embedded DNS (127.0.0.11) — correct on Docker/Docker Desktop, but rootless podman uses a
-# network-specific address (aardvark, e.g. 10.89.0.1), so proxied calls 502 there. Read the actual
-# nameserver from /etc/resolv.conf and substitute it, so the reverse proxy works on any engine.
-#
-# Runs from the nginx image's /docker-entrypoint.d/ before nginx starts. On Docker the nameserver IS
-# 127.0.0.11, so the substitution is a no-op. Guarded (no `set -e`) so it's safe whether the nginx
-# entrypoint executes or sources it.
-ns="$(awk '/^nameserver/{print $2; exit}' /etc/resolv.conf 2>/dev/null)"
-if [ -n "$ns" ] && [ "$ns" != "127.0.0.11" ]; then
-  sed -i "s/resolver 127\.0\.0\.11/resolver $ns/" /etc/nginx/conf.d/default.conf 2>/dev/null || true
-  echo "portal-nginx-resolver: set resolver to $ns"
-fi

apps/self-service/Dockerfile

@@ -19,9 +19,5 @@ COPY --from=build /src/dist/apps/self-service/browser /usr/share/nginx/html
 # Compose-time OIDC config: the browser (Playwright, on the compose network) reaches Keycloak by
 # service name, so the token issuer matches the BFF's authority (host-consistent, ADR-0010).
 RUN printf '{ "authority": "http://keycloak:8080/realms/digid" }\n' > /usr/share/nginx/html/config.json
-# Make the reverse-proxy resolver engine-portable (Docker 127.0.0.11 vs podman aardvark); runs from
-# the nginx image's /docker-entrypoint.d before nginx starts.
-COPY apps/portal-nginx-resolver.sh /docker-entrypoint.d/40-resolver.sh
-RUN chmod +x /docker-entrypoint.d/40-resolver.sh
 
 EXPOSE 80

apps/self-service/src/app/registration/registration-page.html

@@ -3,29 +3,9 @@
     <utrecht-heading-1>Zelfservice — BIG-registratie</utrecht-heading-1>
 
     @if (submitted()) {
-      @if (withdrawn()) {
-        <p utrecht-paragraph role="status">
-          Uw registratie met referentie {{ reference() }} is ingetrokken.
-        </p>
-      } @else {
-        <p utrecht-paragraph role="status">
-          Uw registratie is ontvangen. Referentie: {{ reference() }}.
-        </p>
-        @if (withdrawFailed()) {
-          <p utrecht-paragraph role="alert">
-            Het intrekken van uw registratie is niet gelukt. Probeer het opnieuw.
-          </p>
-        }
-        <button
-          utrecht-button
-          appearance="secondary-action-button"
-          type="button"
-          [disabled]="withdrawing()"
-          (click)="withdraw()"
-        >
-          Trek aanvraag in
-        </button>
-      }
+      <p utrecht-paragraph role="status">
+        Uw registratie is ontvangen. Referentie: {{ reference() }}.
+      </p>
     } @else {
       <p utrecht-paragraph>U bent ingelogd met BSN {{ bsn() }}.</p>
       @if (failed()) {

apps/self-service/src/app/registration/registration-page.spec.ts

@@ -17,22 +17,12 @@ class FakeAuth extends AuthService {
   }
 }
 
-function providers(
-  post = vi.fn().mockReturnValue(of({ registrationId: 'reg-9', status: 'Ingediend' })),
-  withdraw = vi.fn().mockReturnValue(of(undefined)),
-) {
+function providers(post = vi.fn().mockReturnValue(of({ registrationId: 'reg-9', status: 'Ingediend' }))) {
   return {
     post,
-    withdraw,
     providers: [
       { provide: AuthService, useClass: FakeAuth },
-      {
-        provide: BffApiV1Service,
-        useValue: {
-          postSelfServiceRegistrations: post,
-          postSelfServiceRegistrationsIdWithdraw: withdraw,
-        },
-      },
+      { provide: BffApiV1Service, useValue: { postSelfServiceRegistrations: post } },
     ],
   };
 }
@@ -66,36 +56,6 @@ describe('RegistrationPage', () => {
     expect(screen.getByRole('button', { name: /indienen/i })).toBeTruthy();
   });
 
-  it('offers to withdraw after submitting, and withdrawing confirms', async () => {
-    const { withdraw, providers: p } = providers();
-    await render(RegistrationPage, { providers: p });
-
-    fireEvent.click(screen.getByRole('button', { name: /indienen/i }));
-    await screen.findByText(/ontvangen/i);
-
-    fireEvent.click(await screen.findByRole('button', { name: /trek aanvraag in/i }));
-
-    // The withdrawal is keyed by the reference the submit returned, and the page confirms it.
-    expect(withdraw).toHaveBeenCalledWith('reg-9');
-    expect(await screen.findByText(/ingetrokken/i)).toBeTruthy();
-  });
-
-  it('surfaces a withdraw failure and keeps the action available', async () => {
-    const { providers: p } = providers(
-      vi.fn().mockReturnValue(of({ registrationId: 'reg-9', status: 'Ingediend' })),
-      vi.fn().mockReturnValue(throwError(() => new Error('withdraw rejected'))),
-    );
-    await render(RegistrationPage, { providers: p });
-
-    fireEvent.click(screen.getByRole('button', { name: /indienen/i }));
-    await screen.findByText(/ontvangen/i);
-    fireEvent.click(await screen.findByRole('button', { name: /trek aanvraag in/i }));
-
-    expect(await screen.findByRole('alert')).toBeTruthy();
-    expect(screen.queryByText(/is ingetrokken/i)).toBeNull();
-    expect(screen.getByRole('button', { name: /trek aanvraag in/i })).toBeTruthy();
-  });
-
   it('has no WCAG 2.1 AA violations on the submit page', async () => {
     // The portal is Dutch; the real index.html sets lang. Set it here so the document-level
     // html-has-lang rule reflects the app, not the bare jsdom document.

apps/self-service/src/app/registration/registration-page.ts

@@ -6,8 +6,7 @@ import { UtrechtComponentsModule } from 'ui';
 /**
  * The self-service submit page: a signed-in zorgprofessional confirms and submits their BIG
  * registration. The bsn comes from the DigiD token (not a form field), so this is a confirm-and-
- * submit flow that posts to the BFF and shows the returned reference (ADR-0010; S-08c). After
- * submitting they can withdraw it — "trek aanvraag in" — keyed by that reference (S-11c).
+ * submit flow that posts to the BFF and shows the returned reference (ADR-0010; S-08c).
  */
 @Component({
   selector: 'app-registration-page',
@@ -23,9 +22,6 @@ export class RegistrationPage {
   protected readonly reference = signal<string | undefined>(undefined);
   protected readonly submitted = signal(false);
   protected readonly failed = signal(false);
-  protected readonly withdrawing = signal(false);
-  protected readonly withdrawn = signal(false);
-  protected readonly withdrawFailed = signal(false);
 
   submit(): void {
     this.submitting.set(true);
@@ -43,24 +39,4 @@ export class RegistrationPage {
       },
     });
   }
-
-  withdraw(): void {
-    const reference = this.reference();
-    if (!reference) {
-      return;
-    }
-    this.withdrawing.set(true);
-    this.withdrawFailed.set(false);
-    this.bff.postSelfServiceRegistrationsIdWithdraw(reference).subscribe({
-      next: () => {
-        this.withdrawn.set(true);
-        this.withdrawing.set(false);
-      },
-      // Surface the failure instead of swallowing it: keep the action so the user can retry.
-      error: () => {
-        this.withdrawFailed.set(true);
-        this.withdrawing.set(false);
-      },
-    });
-  }
 }

docs/architecture/adr-0014-withdrawal-cancels-the-process.md

@@ -1,72 +0,0 @@
-# ADR-0014: Withdrawal cancels the registratie process via a BPMN message event
-
-- **Status:** Accepted
-- **Date:** 2026-07-16
-- **Deciders:** Respellion engineering
-- **Relates to:** S-11 (#12); builds on ADR-0009 (external-task worker / Workflow Client), ADR-0013
-  (behandel-portal wiring, the Beoordelen user task)
-
-## Context
-
-S-11 lets a zorgprofessional withdraw a still-open registration ("trek aanvraag in"). S-11a already
-advances the aggregate to INGETROKKEN (domain state). But the registratie process is still running in
-Flowable — parked at the `Beoordelen` user task — so without a second step the withdrawn registration
-would linger as work for a behandelaar. The withdrawal must also **cancel the running process**.
-
-Two questions shape this sub-slice.
-
-1. **How does the case get cancelled — in code, or in the BPMN model?**
-2. **How does a withdrawal correlate to the right running process instance?**
-
-## Decision
-
-**The BPMN models the cancellation as an interrupting message boundary event on the `Beoordelen`
-task; the Workflow Client correlates a `RegistratieIngetrokken` message to the task's execution.**
-
-- **Modelled in BPMN, not deleted from code.** The `Beoordelen` user task carries an interrupting
-  message boundary event (`RegistratieIngetrokken`) that routes to a dedicated "Registratie
-  ingetrokken" end event. The process's own model says *how* a withdrawal ends it — the Workflow
-  Client only delivers the message; it never reaches into Flowable to delete an instance. This keeps
-  the workflow's control flow in the workflow (§8.2) and leaves an audit trail in Flowable history
-  (the process ended via the ingetrokken path, not a raw delete).
-- **Correlated by the registration's own process instance.** The aggregate records its Flowable
-  process instance id at submit, so the `WithdrawRegistration` handler correlates directly by that
-  id — no task lookup. The Workflow Client asks Flowable for the execution **subscribed to** the
-  `RegistratieIngetrokken` message in that instance and delivers `messageEventReceived` to it.
-  Targeting the subscribed execution (not the user task's execution — a message boundary event's
-  subscription lives on its own execution) is what makes the correlation land.
-- **Best-effort, mirroring the beoordeling.** If no open `Beoordelen` task is found (the process has
-  not yet parked there — the `OpenZaakAanmaken` window — or has already ended), the withdrawal still
-  stands: the aggregate is INGETROKKEN and the werkbak filters it out regardless (S-11b). We complete
-  the domain transition first and cancel the workflow best-effort, exactly as `BeoordeelRegistratie`
-  completes its task best-effort.
-
-## Consequences
-
-**Positive**
-
-- The cancellation path is visible in `registratie.bpmn`; the Workflow Client stays the only code
-  that talks to Flowable and does not delete instances behind the model's back.
-- Reuses the existing task-query correlation — no new plumbing, no correlation store.
-- A withdrawn case leaves the werkbak (its `Beoordelen` task is cancelled), and the werkbak also
-  filters non-open registrations as a belt-and-braces for the brief window before cancellation lands.
-
-**Negative / costs**
-
-- A withdrawal raced ahead of the process reaching `Beoordelen` (during `OpenZaakAanmaken`, seconds)
-  finds no task to cancel, so that process instance runs on to `Beoordelen` and parks there with no
-  one to act on it (it is hidden from the werkbak by the status filter). Acceptable for this
-  reference at these volumes; a process-level interrupting event subprocess would close the gap and
-  is an additive follow-up if it matters.
-- The Flowable message-correlation REST shape is validated live (verify-stack), not in the
-  Workflow Client's unit tests, which stub the HTTP exchange and assert only the request shape
-  (consistent with ADR-0009).
-
-## Alternatives considered
-
-- **Delete the process instance from the Workflow Client** (`DELETE /runtime/process-instances/{id}`)
-  — rejected: it cancels the case but hides the reason from the BPMN model; the "why" lives in code,
-  not the process. The message event keeps the cancellation a first-class part of the workflow.
-- **Interrupting message event subprocess at process level** — more robust (correlates anytime,
-  closing the `OpenZaakAanmaken`-race gap), but a heavier BPMN construct; deferred as an additive
-  change if the race proves to matter.

docs/architecture/adr-0015-beoordeling-escalation.md

@@ -1,77 +0,0 @@
-# ADR-0015: Beoordeling escalation reassigns via an external-worker task
-
-- **Status:** Accepted
-- **Date:** 2026-07-17
-- **Deciders:** Respellion engineering
-- **Relates to:** S-14 (#15); proposal #98. Builds on ADR-0009 (external-task worker / Workflow
-  Client), ADR-0013 (behandel-portal wiring, the `Beoordelen` user task), ADR-0014 (the boundary-event
-  pattern on `Beoordelen`).
-
-## Context
-
-S-14 escalates a beoordeling that a behandelaar does not pick up in time: after 14 days the case must
-move to the `teamlead` role (PRD §5, flow 5). The `Beoordelen` user task already exists, claimable by
-the `behandelaar` candidate group; the teamlead role is seeded in the medewerker realm.
-
-Two forces shape this.
-
-1. **The task must stay open.** Escalation changes *who may claim* an unclaimed beoordeling, not the
-   work itself — so the timer must be **non-interrupting**: the `Beoordelen` task keeps running while
-   escalation happens alongside it.
-2. **Reassigning an open task's candidate group needs code.** Flowable cannot rewrite the candidate
-   groups of an already-open user task from BPMN XML alone — that requires either a Java delegate/listener
-   embedded in the engine, or an out-of-process actor driving the REST API. The repository has held a
-   "stock Flowable image, no custom jars; the Workflow Client is the only code that talks to Flowable
-   (§8.2)" posture since ADR-0009.
-
-## Decision
-
-**A non-interrupting `P14D` boundary timer on `Beoordelen` fires an external-worker task
-(`BeoordelingEscaleren`); the Workflow Client reassigns the still-open `Beoordelen` task from the
-behandelaar group to teamlead.**
-
-- **Modelled in BPMN, driven by an external worker.** The timer routes a parallel token to an
-  `external-worker` service task on the `BeoordelingEscaleren` topic, ending at a dedicated "Beoordeling
-  geëscaleerd" end event. The model owns *when* escalation happens; the Workflow Client — the only code
-  that talks to Flowable (§8.2) — owns *how* the reassignment is applied, exactly as `OpenZaakAanmaken`
-  delegates the ZGW call (ADR-0009). No custom code runs inside Flowable.
-- **Reassignment is a candidate-group swap.** The escalation worker finds the still-open `Beoordelen`
-  task in the escalating instance (task query by `processInstanceId` + `taskDefinitionKey`), adds
-  `teamlead` as a candidate group via the task identity links, then removes `behandelaar`. The task now
-  belongs to the teamlead; its history and variables are untouched.
-- **Best-effort, mirroring beoordeling and withdrawal.** If the task is no longer open — the behandelaar
-  completed it in the window before the timer fired — the reassignment is a no-op. A failed reassignment
-  leaves the escalation job un-completed so Flowable redelivers it (§8.6), consistent with the
-  `OpenZaakAanmaken` worker.
-- **Segregated interface.** The escalation methods live on `IBeoordelingEscalatieClient`, separate from
-  the `OpenZaakAanmaken` worker's `IExternalWorkerClient`, so the OpenZaak worker never sees escalation
-  (interface segregation). Both are implemented by the one `FlowableWorkflowClient`.
-
-## Consequences
-
-**Positive**
-
-- The escalation trigger is visible in `registratie.bpmn`; Flowable stays a stock image, and the
-  Workflow Client remains the sole Flowable client (§8.2 upheld, not bent).
-- Reuses the external-worker mechanics (topic acquire/complete, hosted pump, per-tick scope,
-  redelivery-on-failure) wholesale — the new code is one client capability, one processor, one pump.
-- Escalation latency is bounded by the worker's poll interval (seconds) — negligible against a 14-day
-  timer.
-
-**Negative / costs**
-
-- Escalation is two REST hops (add teamlead, remove behandelaar) rather than one atomic update; between
-  them the task is briefly claimable by both groups. Harmless at these volumes, and the pair is idempotent
-  on redelivery.
-- The Flowable identity-link and management-job REST shapes are validated live (verify-domain fires the
-  timer early via the management API), not in the Workflow Client's unit tests, which stub the HTTP
-  exchange and assert only the request shape — consistent with ADR-0009 and ADR-0014.
-
-## Alternatives considered
-
-- **Flowable timer/task listener (Java delegate).** Reassign in-engine when the timer fires. Rejected:
-  it needs a custom jar in Flowable, breaking the stock-image, REST-only posture and adding a build/deploy
-  surface to the engine for no capability the external-worker route lacks.
-- **Interrupting timer that re-creates the task for teamlead.** Cancel `Beoordelen` and start a fresh
-  teamlead task. Rejected: it loses the task's identity/history and complicates correlation, where a
-  candidate-group swap on the same task expresses "the same work, now the teamlead's" directly.

docs/architecture/adr-0016-diploma-eligibility-dmn.md

@@ -1,66 +0,0 @@
-# ADR-0016: Diploma eligibility is a DMN evaluated inline as a BPMN businessRuleTask
-
-- **Status:** Accepted
-- **Date:** 2026-07-17
-- **Deciders:** Respellion engineering
-- **Relates to:** S-13 (#14); proposal #100. Builds on ADR-0009 (external-task worker / Workflow
-  Client), ADR-0014/0015 (the boundary-event and routing constructs on the registratie process).
-
-## Context
-
-S-13 adds flow 4: a foreign diploma must get an extra CBGV-advies assessment before beoordeling
-(PRD §5). The eligibility decision — domestic goes straight to beoordeling, foreign routes through
-CBGV-advies — needs a home. The Flowable REST app bundles a DMN engine, and the same
-`repository/deployments` machinery that deploys `registratie.bpmn` can deploy a `.dmn`. §8.2 makes
-the Workflow Client the only code that talks to Flowable; the PRD frames the workflow as "BPMN + DMN
-governing the registration workflow" (Flowable as a peer orchestration module).
-
-The issue's wording ("a DMN decision table evaluated by the Domain Service via Workflow Client")
-suggests the domain reaches into Flowable's DMN API to evaluate the decision and feeds the result
-back. That is one option; it is not the only one, and it is not the cleanest.
-
-## Decision
-
-**The diploma-eligibility DMN is deployed to Flowable and evaluated inline by the registratie process
-as a `businessRuleTask`; an exclusive gateway routes on its output. The domain's only new job is to
-carry the diploma origin and pass it into the process as a start variable.**
-
-- **The decision lives in the workflow.** `workflows/diploma-eligibility.dmn` maps `diplomaOrigin`
-  → `route` (`Buitenlands` ⇒ `CBGV_ADVIES`, otherwise `DIRECT`). A `businessRuleTask`
-  (`flowable:type="dmn"`, `decisionTableReferenceKey=diploma-eligibility`) runs it between
-  `OpenZaakAanmaken` and `Beoordelen`, and an exclusive gateway sends `CBGV_ADVIES` through a new
-  `CBGVAdvies` user task before `Beoordelen`, `DIRECT` straight there.
-- **The domain carries the input, not the decision.** The `Registration` aggregate gains a
-  `DiplomaOrigin` (Binnenlands/Buitenlands); `SubmitRegistration` passes it to
-  `StartRegistrationProcessAsync`, which sets it as the `diplomaOrigin` start variable. The domain
-  never evaluates the DMN and never learns the route — that is the process's concern.
-- **Deployed like the BPMN.** The DMN is version-controlled in `workflows/` and deployed to the DMN
-  engine by the same `flowable-init` step (via `dmn-api/dmn-repository/deployments`), staged into the
-  `fl-bpmn` volume alongside the BPMN.
-
-## Consequences
-
-**Positive**
-
-- The eligibility rule is a first-class, inspectable workflow artefact (matching the PRD's BPMN+DMN
-  framing); business users can read/adjust the decision table without touching domain code.
-- §8.2 stays clean: the Workflow Client remains the only code talking to Flowable, and the decision
-  runs inside the process the client already started — no domain→Flowable round-trip for a decision.
-- The domain change is minimal and additive: one value on the aggregate, one start variable.
-
-**Negative / costs**
-
-- Deviates from #14's literal "evaluated by the Domain Service via Workflow Client" wording (noted on
-  the issue). The outcome — DMN decides eligibility, foreign diplomas get the CBGV step — is unchanged.
-- The DMN and its `businessRuleTask` wiring are validated live (verify-domain drives a foreign
-  registration through CBGV-advies and a domestic one straight to beoordeling, exercising both
-  branches), not in unit tests — consistent with ADR-0009/0014/0015. The domain unit/acceptance tests
-  cover only that the origin is carried into the process.
-
-## Alternatives considered
-
-- **Domain evaluates the DMN via the Workflow Client** (the issue's wording). Rejected: it couples
-  the domain to Flowable for a decision and splits the routing across two places (domain computes,
-  BPMN branches), for no benefit over letting the engine that owns the process own the decision.
-- **Eligibility rules in domain C#.** Rejected: it moves a governable business decision out of the
-  DMN the PRD calls for, and hard-codes what the reference app is meant to demonstrate as data.

docs/demo-script.md

@@ -248,137 +248,3 @@ curl -fsS "http://localhost:8140/openbaar/register?q=$ref" | jq
 
 > The openbaar register's "Referentie" column and its search now use this reference — the exact value
 > the citizen saw on submit. Asserted end-to-end by the Playwright happy path.
-
-## S-12 — Behandel portal: werkbak + beoordeling (#13, ADR-0013)
-
-A behandelaar now works submitted registrations in a real portal instead of the temporary admin
-endpoint. After a citizen submits (as above), the workflow parks the registration at the Flowable
-`Beoordelen` user task, and it shows up in the **werkbak**. The behandelaar logs in against the
-Keycloak `medewerker` realm and decides — **goedkeuren** (→ INGESCHREVEN via the ACL, per ADR-0011)
-or **afwijzen** — which also completes the Beoordelen task so the process advances.
-
-```text
-# 1. Open the behandel portal and log in as a behandelaar (medewerker realm):
-#    http://localhost:8142/   →  merel-behandelaar / test123
-#
-# 2. The werkbak lists the registrations awaiting beoordeling (referentie / bsn / status).
-#    Find the reference from the submit confirmation and click "Goedkeuren" on that row.
-#
-# 3. The row drops off the werkbak (its Beoordelen task is completed) and the openbaar register
-#    (http://localhost:8141/) now shows that reference as INGESCHREVEN.
-```
-
-**The path:** behandel portal → BFF `POST /behandel/registrations/{id}/decide` (behandelaar policy,
-`medewerker` realm) → domain applies the decision + completes the Flowable `Beoordelen` task →
-ACL → NRC → event-subscriber → projection → openbaar register shows INGESCHREVEN.
-
-> The full round-trip — DigiD submit → public INGEDIEND → behandelaar goedkeurt in the werkbak →
-> public INGESCHREVEN — is the Playwright happy path (`tests/e2e/registration.spec.ts`), which now
-> drives the behandel portal in place of the old admin endpoint.
-
-## S-11 — Withdrawal: "trek aanvraag in" (#12, ADR-0014)
-
-A zorgprofessional can withdraw their own still-open registration from the self-service portal. The
-withdrawal is owner-scoped (the BFF forwards the DigiD token's bsn; the domain only lets the owner
-withdraw) and cancels the running workflow via a BPMN message event, so the case leaves the
-behandelaar's werkbak.
-
-```text
-# 1. Log in and submit at the self-service portal (http://localhost:8140/, jan-burger / test123),
-#    note the "Referentie" on the confirmation.
-# 2. Click "Trek aanvraag in" → the page confirms the registration is ingetrokken.
-# 3. In the behandel werkbak (http://localhost:8142/, merel-behandelaar) the registration no longer
-#    appears — its Beoordelen task was cancelled.
-```
-
-**The path:** self-service → BFF `POST /self-service/registrations/{id}/withdraw` (DigiD, owner-scoped)
-→ domain sets INGETROKKEN + correlates the `RegistratieIngetrokken` message to the process → the
-interrupting boundary event ends it → the werkbak drops the case.
-
-> DigiD submit → trek aanvraag in → ingetrokken is the Playwright happy path
-> (`tests/e2e/withdrawal.spec.ts`); the owner-scoping + workflow cancellation are covered by the
-> `Een registratie intrekken` acceptance scenarios and the domain live check.
-
-## S-14 — Beoordeling escalation: 14 days unclaimed → teamlead (#15, ADR-0015)
-
-A beoordeling a behandelaar does not pick up within 14 days escalates to the teamlead. A
-non-interrupting boundary timer on the `Beoordelen` task fires a `BeoordelingEscaleren` external task;
-the domain's escalation worker reassigns the still-open task's candidate group from `behandelaar` to
-`teamlead`, so it moves from the behandelaar werkbak into the teamlead's. The `Beoordelen` task keeps
-its identity throughout — only who may claim it changes.
-
-The timer is 14 days, so the demo fires it early through Flowable's management API (exactly what the
-verify-domain check automates):
-
-```bash
-# 1. Submit at the self-service portal (http://localhost:8140/, jan-burger / test123). The case
-#    parks at Beoordelen, visible in the behandelaar werkbak (http://localhost:8142/, merel-behandelaar)
-#    but NOT claimed.
-#
-# 2. Find the parked instance and its Beoordelen task, then fire the boundary timer early:
-FL=http://localhost:8090/flowable-rest/service
-PID=$(curl -s -u rest-admin:test -X POST "$FL/query/tasks" -H 'Content-Type: application/json' \
-  -d '{"processDefinitionKey":"registratie","taskDefinitionKey":"Beoordelen"}' \
-  | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["processInstanceId"])')
-TID=$(curl -s -u rest-admin:test -X POST "$FL/query/tasks" -H 'Content-Type: application/json' \
-  -d '{"processDefinitionKey":"registratie","taskDefinitionKey":"Beoordelen"}' \
-  | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["id"])')
-TJ=$(curl -s -u rest-admin:test "$FL/management/timer-jobs?processInstanceId=$PID" \
-  | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["id"])')
-curl -s -u rest-admin:test -X POST "$FL/management/timer-jobs/$TJ" \
-  -H 'Content-Type: application/json' -d '{"action":"move"}'
-AJ=$(curl -s -u rest-admin:test "$FL/management/jobs?processInstanceId=$PID" \
-  | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["id"])')
-curl -s -u rest-admin:test -X POST "$FL/management/jobs/$AJ" \
-  -H 'Content-Type: application/json' -d '{"action":"execute"}'
-#
-# 3. Within a couple of poll cycles the task's candidate group flips to teamlead:
-curl -s -u rest-admin:test "$FL/runtime/tasks/$TID/identitylinks"   # → [{"group":"teamlead","type":"candidate"}]
-```
-
-**The path:** BPMN non-interrupting `P14D` boundary timer on `Beoordelen` → `BeoordelingEscaleren`
-external task → domain escalation worker (`BeoordelingEscalatiePump`) → Workflow Client swaps the task's
-candidate group behandelaar → teamlead (§8.2).
-
-> Both branches (escalate after 14 days; no-op when completed in time) are covered by the
-> `Een beoordeling escaleren` acceptance scenarios and the Workflow Client unit tests; the timer firing
-> and reassignment are asserted live by the verify-domain check.
-
-## S-13 — Diploma-eligibility: foreign diplomas route through CBGV-advies (#14, ADR-0016)
-
-A registration's diploma origin decides its route. A DMN `businessRuleTask` in the registratie
-process evaluates the `diploma-eligibility` decision on the `diplomaOrigin` start variable: a
-**foreign** (Buitenlands) diploma is routed through an extra **CBGV-advies** user task before
-beoordeling; a **domestic** (Binnenlands) one goes straight to beoordeling. The decision lives in the
-DMN, not in code — a beheerder can read and adjust the decision table directly.
-
-The self-service portal's eIDAS→foreign wiring is a later slice; for now the origin is submitted to
-the domain directly, so the demo drives it through the domain endpoint:
-
-```bash
-# 1. Submit a foreign-diploma registration to the domain (note the returned Location/reference):
-DOM=http://localhost:8080   # domain service
-curl -s -i -X POST "$DOM/registrations" -H 'Content-Type: application/json' \
-  -d '{"bsn":"123456782","diplomaOrigin":"Buitenlands"}' | grep -i '^location:'
-#
-# 2. Once the zaak is opened, the process parks at the CBGV-advies task (NOT Beoordelen). In Flowable:
-FL=http://localhost:8090/flowable-rest/service
-curl -s -u rest-admin:test -X POST "$FL/query/tasks" -H 'Content-Type: application/json' \
-  -d '{"processDefinitionKey":"registratie","taskDefinitionKey":"CBGVAdvies"}' | python3 -m json.tool
-#
-# 3. Complete the CBGV-advies task; the case then advances to the regular Beoordelen task:
-TID=$(curl -s -u rest-admin:test -X POST "$FL/query/tasks" -H 'Content-Type: application/json' \
-  -d '{"processDefinitionKey":"registratie","taskDefinitionKey":"CBGVAdvies"}' \
-  | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"][0]["id"])')
-curl -s -u rest-admin:test -X POST "$FL/runtime/tasks/$TID" \
-  -H 'Content-Type: application/json' -d '{"action":"complete"}'
-# A domestic submission (default, or "Binnenlands") skips CBGV-advies and parks straight at Beoordelen.
-```
-
-**The path:** domain sets the `diplomaOrigin` start variable → registratie process DMN
-`businessRuleTask` sets `route` → exclusive gateway → foreign: `CBGVAdvies` user task → `Beoordelen`;
-domestic: `Beoordelen` directly (§8.2, ADR-0016).
-
-> The domestic/foreign paths are covered by the `Een diploma op herkomst routeren` acceptance
-> scenarios and unit tests (the origin is carried into the process); the DMN decision and the
-> foreign→CBGV routing are asserted live by the verify-domain check.

docs/frontend-decisions.md

@@ -117,53 +117,3 @@ with the submit form (S-08c, #67); any deviation from NL DS will be recorded her
   (id + status); `bsn`/`naam` never leave the BFF. The e2e asserts the bsn never renders.
 - **Loads on open, filters on search.** `RegisterPage` fetches the full register on construction and
   re-queries `/openbaar/register?q=` on search — no client-side filtering, the BFF owns the query.
-
-## Behandel portal (S-12, #13)
-
-The staff portal where a behandelaar works the **werkbak** (registrations awaiting beoordeling) and
-decides each — goedkeuren or afwijzen. `apps/behandel` mirrors `apps/self-service`; the net-new
-frontend work is the medewerker realm auth and the werkbak/decide page. Wiring rationale is in
-**ADR-0013**; this entry records the frontend-specific choices.
-
-- **Medewerker realm auth, reusing `libs/auth`.** Staff authenticate against the Keycloak
-  `medewerker` realm (public client `big-portal`), not `digid`. Rather than fork the auth lib, the
-  abstract `AuthService` grew a **`roles`/`hasRole` surface** (empty for realms without roles, e.g.
-  `digid`), and a parallel **`MedewerkerAuthService` + `provideMedewerkerAuth`** were added — same
-  auth-code + PKCE config, bound to the medewerker realm, reading the nested `realm_access.roles`
-  claim. The library's own `authInterceptor` attaches the token to the relative `/behandel/` calls
-  (secure route), exactly as self-service does for `/self-service/`.
-- **Roles reach the frontend via a realm mapper.** Keycloak emits realm roles in the access token by
-  default but not the ID token/userinfo the SPA reads, so the medewerker `big-portal` client gets a
-  **realm-roles protocol mapper** (`realm_access.roles`, added to id + userinfo tokens). The
-  **BFF remains the security boundary** (`behandelaar` policy, 401/403 on `/behandel/*`, ADR-0013);
-  the frontend role signal is for display/UX, and the werkbak page surfaces a load failure (e.g. a
-  403 for a non-behandelaar) rather than swallowing it.
-- **Same-origin via nginx, like the other portals.** The compose `behandel` image serves the built
-  app and reverse-proxies `/behandel` to the BFF (relative calls, no CORS). Served on `:8142`,
-  health-checked over IPv4 (`127.0.0.1`), depends on Keycloak for the medewerker realm.
-- **Werkbak = decide-and-refresh.** `WerkbakPage` loads `GET /behandel/werkbak` on open and renders a
-  row per registration (referentie/bsn/status). Goedkeuren/afwijzen `POST /behandel/registrations/
-  {id}/decide` and then reload the werkbak, so the handled item drops off (its Flowable `Beoordelen`
-  task is completed). Per-row decide buttons carry an `aria-label` including the reference, so the
-  e2e (and screen readers) can target a specific registration in a shared werkbak.
-- **Testing.** Component tests use `@testing-library/angular` with `BffApiV1Service`/`AuthService`
-  mocked and the axe WCAG 2.1 AA check; an `app.config.spec` drives the real interceptor + api-client
-  to assert the medewerker token attaches to `/behandel/*` (and not to the anonymous openbaar call).
-  The full DigiD-submit → behandel-decide → public INGESCHREVEN round-trip is the Playwright happy
-  path.
-
-## Self-service withdrawal: "trek aanvraag in" (S-11c, #12)
-
-The submit confirmation grows a **"Trek aanvraag in"** action so a zorgprofessional can withdraw the
-registration they just submitted (`apps/self-service`, on the existing `RegistrationPage`).
-
-- **Keyed by the reference, owner-scoped at the BFF.** The button calls the generated
-  `postSelfServiceRegistrationsIdWithdraw(reference)` with the reference the submit returned. The
-  DigiD token (attached by the interceptor) carries the bsn the BFF forwards; the domain only lets
-  the owner withdraw (a mismatch is 404). No extra identity is entered in the UI.
-- **Same confirm-and-surface pattern as submit.** A secondary-action button; on success the page
-  switches to an ingetrokken confirmation; a failure is surfaced (`role="alert"`) and the action
-  stays available to retry — mirroring how submit handles its failure rather than swallowing it.
-- **Testing.** Component tests (`@testing-library/angular`, mocked BFF) cover the button appearing
-  after submit, the reference being passed, the ingetrokken confirmation, and the failure path; the
-  browser round-trip is `tests/e2e/withdrawal.spec.ts`.

infra/docker-compose.local.yml

@@ -17,12 +17,7 @@
 #
 # Port map (host):
 #   8000 OpenZaak · 8001 Open Notificaties · 8080 BFF · 8090 Flowable REST
-#   8100 ACL · 8130 Domain · 8180 Keycloak   (all admin: admin / admin — dev only)
-#   8140 self-service portal · 8141 openbaar register · 8142 behandel portal
-#
-# Portal OIDC on the HOST: browse the portals at their 8140/8141/8142 ports and log in via
-# Keycloak on localhost:8180 (KC_HOSTNAME below pins the issuer there; the BFF still validates
-# in-network via keycloak:8080). Test users are in docs/synthetic-data.md.
+#   8100 ACL · 8180 Keycloak   (all admin: admin / admin — dev only)
 
 services:
 
@@ -210,12 +205,6 @@ services:
       KEYCLOAK_ADMIN_PASSWORD: admin
       KC_HEALTH_ENABLED: "true"
       KC_HTTP_ENABLED: "true"
-      # Pin the frontend/issuer URL to the host-published address so a browser on the host and the
-      # tokens it gets both use localhost:8180. KC_HOSTNAME_BACKCHANNEL_DYNAMIC lets in-network
-      # callers (the BFF via keycloak:8080) still resolve token/jwks endpoints to their request host,
-      # so the BFF validates the localhost:8180 issuer while fetching keys over the compose network.
-      KC_HOSTNAME: http://localhost:8180
-      KC_HOSTNAME_BACKCHANNEL_DYNAMIC: "true"
     ports:
       - "8180:8080"
     volumes:
@@ -306,14 +295,6 @@ services:
       context: ../services/bff
       dockerfile: Dockerfile
     image: register-referentie/bff:dev
-    environment:
-      # Reach Keycloak over the compose network for metadata/keys; the discovered issuer is the
-      # host-pinned localhost:8180 (KC_HOSTNAME above), which is what browser tokens carry — so
-      # validation matches without the BFF ever needing to resolve localhost:8180 itself.
-      Keycloak__Authority: http://keycloak:8080/realms/digid
-      Keycloak__MedewerkerAuthority: http://keycloak:8080/realms/medewerker
-      Downstream__Domain__BaseUrl: http://domain:8080/
-      Downstream__Projection__BaseUrl: http://projection-api:8080/
     ports:
       - "8080:8080"
     healthcheck:
@@ -322,39 +303,6 @@ services:
       timeout: 3s
       retries: 5
       start_period: 10s
-    depends_on:
-      domain:
-        condition: service_healthy
-      projection-api:
-        condition: service_healthy
-      keycloak:
-        condition: service_started
-    networks: [cg]
-
-  # ── BIG Domain Service (S-05) ─────────────────────────────────────────────
-  domain:
-    build:
-      context: ../services/domain
-      dockerfile: Dockerfile
-    image: register-referentie/domain:dev
-    environment:
-      Flowable__BaseUrl: http://flowable-rest:8080/flowable-rest/
-      Flowable__Username: rest-admin
-      Flowable__Password: test
-      Acl__BaseUrl: http://acl:8080/
-    ports:
-      - "8130:8080"
-    healthcheck:
-      test: ["CMD", "curl", "-fsS", "http://localhost:8080/health"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 10s
-    depends_on:
-      acl:
-        condition: service_healthy
-      flowable-init:
-        condition: service_completed_successfully
     networks: [cg]
 
   # ── Read projection (S-06) ────────────────────────────────────────────────
@@ -380,10 +328,6 @@ services:
     image: register-referentie/event-subscriber:dev
     environment:
       ConnectionStrings__Projection: Host=projection-db;Database=projection;Username=projection;Password=projection
-      # The subscriber enriches the projection with each zaak's reference by asking the ACL — the only
-      # code allowed to read ZGW (§8.1, #78). Required: startup throws without it (parity with the
-      # canonical compose).
-      Acl__BaseUrl: http://acl:8080/
       EventSubscriber__Webhook__AuthToken: ${NOTIFICATION_WEBHOOK_TOKEN:-Bearer big-reference-notifications}
     ports:
       - "8110:8080"
@@ -396,8 +340,6 @@ services:
     depends_on:
       projection-db:
         condition: service_healthy
-      acl:
-        condition: service_healthy
     networks: [cg]
 
   projection-api:
@@ -420,73 +362,6 @@ services:
         condition: service_healthy
     networks: [cg]
 
-  # ── Portals (S-08/S-09/S-12) ──────────────────────────────────────────────
-  # nginx serves each Angular app and reverse-proxies its endpoint group to the BFF (same-origin).
-  # The images bake config.json with the compose authority (keycloak:8080), which a HOST browser
-  # can't resolve — so here we bind-mount a config.json pointing at the host-published localhost:8180
-  # (matching KC_HOSTNAME). openbaar is anonymous and needs no config.
-  self-service:
-    build:
-      context: ..
-      dockerfile: apps/self-service/Dockerfile
-    image: register-referentie/self-service:dev
-    ports:
-      - "8140:80"
-    volumes:
-      - ./local-config/self-service.config.json:/usr/share/nginx/html/config.json:ro,z
-    healthcheck:
-      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 10s
-    depends_on:
-      bff:
-        condition: service_healthy
-      keycloak:
-        condition: service_started
-    networks: [cg]
-
-  openbaar:
-    build:
-      context: ..
-      dockerfile: apps/openbaar/Dockerfile
-    image: register-referentie/openbaar:dev
-    ports:
-      - "8141:80"
-    healthcheck:
-      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 10s
-    depends_on:
-      bff:
-        condition: service_healthy
-    networks: [cg]
-
-  behandel:
-    build:
-      context: ..
-      dockerfile: apps/behandel/Dockerfile
-    image: register-referentie/behandel:dev
-    ports:
-      - "8142:80"
-    volumes:
-      - ./local-config/behandel.config.json:/usr/share/nginx/html/config.json:ro,z
-    healthcheck:
-      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 10s
-    depends_on:
-      bff:
-        condition: service_healthy
-      keycloak:
-        condition: service_started
-    networks: [cg]
-
 volumes:
   oz-db:
   nrc-db:

infra/docker-compose.yml

@@ -259,7 +259,7 @@ services:
   flowable-init:
     image: docker.io/curlimages/curl:latest
     restart: "no"
-    # registratie.bpmn + diploma-eligibility.dmn are streamed into this external volume by infra/seed-config.sh.
+    # registratie.bpmn is streamed into this external volume by infra/seed-config.sh.
     volumes:
       - fl-bpmn:/work:ro
     command:
@@ -267,15 +267,7 @@ services:
       - -c
       - |
         base=http://flowable-rest:8080/flowable-rest/service/repository/deployments
-        dmnbase=http://flowable-rest:8080/flowable-rest/dmn-api/dmn-repository/deployments
         until curl -sf -u rest-admin:test "$$base" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
-        # Deploy the diploma-eligibility DMN to the DMN engine so the registratie process's
-        # businessRuleTask can resolve it by key (S-13, ADR-0016).
-        if curl -s -u rest-admin:test "$$dmnbase?name=diploma-eligibility" | grep -q '"name":"diploma-eligibility"'; then
-          echo "diploma-eligibility already deployed; skip"
-        else
-          curl -sf -u rest-admin:test -F 'file=@/work/diploma-eligibility.dmn;filename=diploma-eligibility.dmn' "$$dmnbase" >/dev/null && echo "deployed diploma-eligibility"
-        fi
         if curl -s -u rest-admin:test "$$base?name=registratie" | grep -q '"name":"registratie"'; then
           echo "registratie already deployed; skip"
         else
@@ -494,29 +486,6 @@ services:
         condition: service_healthy
     networks: [cg]
 
-  # The behandel portal: nginx serves the Angular app and reverse-proxies /behandel to the BFF.
-  # Behandelaars log in against the Keycloak medewerker realm (ADR-0013; S-12).
-  behandel:
-    build:
-      context: ..
-      dockerfile: apps/behandel/Dockerfile
-    image: register-referentie/behandel:dev
-    ports:
-      - "8142:80"
-    healthcheck:
-      # 127.0.0.1, not localhost: nginx listens on IPv4 only, but localhost resolves to ::1 first.
-      test: ["CMD-SHELL", "wget -q -O /dev/null http://127.0.0.1/ || exit 1"]
-      interval: 5s
-      timeout: 3s
-      retries: 5
-      start_period: 10s
-    depends_on:
-      bff:
-        condition: service_healthy
-      keycloak:
-        condition: service_started
-    networks: [cg]
-
 volumes:
   oz-db:
   nrc-db:

infra/flowable/docker-compose.yml

@@ -35,12 +35,12 @@ services:
         condition: service_healthy
     networks: [cg]
 
-  # Deploys workflows/registratie.bpmn + diploma-eligibility.dmn via the REST API once flowable-rest is up.
-  # Idempotent: skips each if a deployment of that name already exists.
+  # Deploys workflows/registratie.bpmn via the REST API once flowable-rest is up.
+  # Idempotent: skips if a deployment named "registratie" already exists.
   flowable-init:
     image: docker.io/curlimages/curl:latest
     restart: "no"
-    # registratie.bpmn + diploma-eligibility.dmn are streamed into this external volume by infra/seed-config.sh.
+    # registratie.bpmn is streamed into this external volume by infra/seed-config.sh.
     volumes:
       - fl-bpmn:/work:ro
     command:
@@ -48,15 +48,7 @@ services:
       - -c
       - |
         base=http://flowable-rest:8080/flowable-rest/service/repository/deployments
-        dmnbase=http://flowable-rest:8080/flowable-rest/dmn-api/dmn-repository/deployments
         until curl -sf -u rest-admin:test "$$base" >/dev/null 2>&1; do echo "waiting for flowable-rest..."; sleep 3; done
-        # Deploy the diploma-eligibility DMN to the DMN engine so the registratie process's
-        # businessRuleTask can resolve it by key (S-13, ADR-0016).
-        if curl -s -u rest-admin:test "$$dmnbase?name=diploma-eligibility" | grep -q '"name":"diploma-eligibility"'; then
-          echo "diploma-eligibility already deployed; skip"
-        else
-          curl -sf -u rest-admin:test -F 'file=@/work/diploma-eligibility.dmn;filename=diploma-eligibility.dmn' "$$dmnbase" >/dev/null && echo "deployed diploma-eligibility"
-        fi
         if curl -s -u rest-admin:test "$$base?name=registratie" | grep -q '"name":"registratie"'; then
           echo "registratie already deployed; skip"
         else

infra/keycloak/realms/medewerker-realm.json

@@ -16,22 +16,7 @@
       "standardFlowEnabled": true,
       "directAccessGrantsEnabled": true,
       "redirectUris": ["*"],
-      "webOrigins": ["*"],
-      "protocolMappers": [
-        {
-          "name": "realm roles",
-          "protocol": "openid-connect",
-          "protocolMapper": "oidc-usermodel-realm-role-mapper",
-          "config": {
-            "multivalued": "true",
-            "claim.name": "realm_access.roles",
-            "jsonType.label": "String",
-            "id.token.claim": "true",
-            "access.token.claim": "true",
-            "userinfo.token.claim": "true"
-          }
-        }
-      ]
+      "webOrigins": ["*"]
     }
   ],
   "users": [

infra/local-config/behandel.config.json

@@ -1,3 +0,0 @@
-{
-  "authority": "http://localhost:8180/realms/medewerker"
-}

infra/local-config/self-service.config.json

@@ -1,3 +0,0 @@
-{
-  "authority": "http://localhost:8180/realms/digid"
-}

infra/run-domain-check.sh

@@ -79,9 +79,9 @@ fl="$(docker ps -q --filter 'name=flowable-rest' | head -1)"
 fl_base="http://$(ip "$fl"):8080/flowable-rest/service"
 reg_id="${loc##*/}"
 
-# Extracts the Beoordelen task id for a given registration from a Flowable task-query response on
-# stdin. Tolerates an empty/non-JSON body (a transient failure during the poll) by printing nothing.
-task_for_reg() { REG_ID="$1" python3 -c "import os,sys,json
+# Extracts the Beoordelen task id for our registration from a Flowable task-query response on stdin.
+# Tolerates an empty/non-JSON body (a transient failure during the poll) by printing nothing.
+task_for_reg() { REG_ID="$reg_id" python3 -c "import os,sys,json
 try:
     d=json.load(sys.stdin)
 except Exception:
@@ -98,7 +98,7 @@ echo ">> polling Flowable for the Beoordelen user task (werkbak)"
 task_id=""
 for _ in $(seq 1 30); do
   resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query" 2>/dev/null || true)"
-  task_id="$(printf '%s' "$resp" | task_for_reg "$reg_id")"
+  task_id="$(printf '%s' "$resp" | task_for_reg)"
   [ -n "$task_id" ] && break
   sleep 2
 done
@@ -115,167 +115,7 @@ flcurl -X POST "$fl_base/runtime/tasks/$task_id" -H 'Content-Type: application/j
 
 echo ">> asserting the process finished (no Beoordelen task remains for the registration)"
 resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query")"
-still="$(printf '%s' "$resp" | task_for_reg "$reg_id")"
+still="$(printf '%s' "$resp" | task_for_reg)"
 [ -z "$still" ] || { echo "FAIL — Beoordelen task $still still active after completion" >&2; exit 1; }
 echo "OK — behandelaar claimed and completed the Beoordelen task; the registratie process finished"
-
-# ── S-11: withdrawal. A second registration parks at Beoordelen; the citizen withdraws it via the
-# domain, which delivers the RegistratieIngetrokken message to the task's execution, tripping the
-# BPMN boundary event so the process ends and the Beoordelen task disappears (ADR-0014). ────────────
-echo ">> submitting a second registration to withdraw"
-loc2="$(docker run --rm --network "$net" curlimages/curl:latest \
-  -fsS -D - -o /dev/null -X POST "http://$dom_ip:8080/registrations" \
-  -H 'Content-Type: application/json' -d '{"bsn":"123456782"}' \
-  | sed -n 's/\r$//; s/^[Ll]ocation: //p' | head -1)"
-[ -n "$loc2" ] || { echo "FAIL — second POST /registrations returned no Location" >&2; exit 1; }
-reg_id2="${loc2##*/}"
-echo ">> second registration $reg_id2"
-
-echo ">> polling Flowable for its Beoordelen task"
-task_id2=""
-for _ in $(seq 1 30); do
-  resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query" 2>/dev/null || true)"
-  task_id2="$(printf '%s' "$resp" | task_for_reg "$reg_id2")"
-  [ -n "$task_id2" ] && break
-  sleep 2
-done
-[ -n "$task_id2" ] || { echo "FAIL — no Beoordelen task appeared for registration $reg_id2" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
-echo ">> Beoordelen task $task_id2 is waiting; withdrawing the registration via the domain"
-
-# Owner-scoped: the withdraw carries the same bsn the registration was submitted with (S-11c).
-docker run --rm --network "$net" curlimages/curl:latest \
-  -fsS -X POST "http://$dom_ip:8080/registrations/$reg_id2/withdraw" \
-  -H 'Content-Type: application/json' -d '{"bsn":"123456782"}' >/dev/null
-
-echo ">> asserting the process was cancelled (no Beoordelen task remains for the registration)"
-gone=""
-for _ in $(seq 1 15); do
-  resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query" 2>/dev/null || true)"
-  still2="$(printf '%s' "$resp" | task_for_reg "$reg_id2")"
-  [ -z "$still2" ] && { gone=1; break; }
-  sleep 2
-done
-[ -n "$gone" ] || { echo "FAIL — Beoordelen task for $reg_id2 still active after withdrawal" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
-echo "OK — withdrawal cancelled the Beoordelen task; the registratie process ended (ingetrokken)"
-
-# ── S-13: diploma-eligibility routing. A registration with a FOREIGN diploma must route through the
-# extra CBGVAdvies user task before Beoordelen (the DMN businessRuleTask sets route=CBGV_ADVIES and the
-# gateway branches, ADR-0016). The domestic DIRECT path is already proven by the first registration
-# above, which parked straight at Beoordelen. ──────────────────────────────────────────────────────
-cbgv_query='{"processDefinitionKey":"registratie","taskDefinitionKey":"CBGVAdvies","includeProcessVariables":true}'
-echo ">> submitting a registration with a foreign diploma"
-locf="$(docker run --rm --network "$net" curlimages/curl:latest \
-  -fsS -D - -o /dev/null -X POST "http://$dom_ip:8080/registrations" \
-  -H 'Content-Type: application/json' -d '{"bsn":"123456782","diplomaOrigin":"Buitenlands"}' \
-  | sed -n 's/\r$//; s/^[Ll]ocation: //p' | head -1)"
-[ -n "$locf" ] || { echo "FAIL — foreign POST /registrations returned no Location" >&2; exit 1; }
-reg_idf="${locf##*/}"
-echo ">> foreign registration $reg_idf"
-
-echo ">> polling Flowable for its CBGV-advies task (foreign diplomas route here first)"
-cbgv_task=""
-for _ in $(seq 1 30); do
-  resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$cbgv_query" 2>/dev/null || true)"
-  cbgv_task="$(printf '%s' "$resp" | task_for_reg "$reg_idf")"
-  [ -n "$cbgv_task" ] && break
-  sleep 2
-done
-[ -n "$cbgv_task" ] || { echo "FAIL — no CBGVAdvies task appeared for the foreign registration $reg_idf" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
-echo ">> CBGVAdvies task $cbgv_task is waiting"
-
-echo ">> asserting it has NOT reached Beoordelen yet (still awaiting CBGV-advies)"
-resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query")"
-early="$(printf '%s' "$resp" | task_for_reg "$reg_idf")"
-[ -z "$early" ] || { echo "FAIL — foreign registration reached Beoordelen ($early) before CBGV-advies" >&2; exit 1; }
-
-echo ">> completing the CBGV-advies task"
-flcurl -X POST "$fl_base/runtime/tasks/$cbgv_task" -H 'Content-Type: application/json' -d '{"action":"complete"}' >/dev/null
-
-echo ">> asserting it now advances to Beoordelen"
-onward=""
-for _ in $(seq 1 15); do
-  resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query" 2>/dev/null || true)"
-  [ -n "$(printf '%s' "$resp" | task_for_reg "$reg_idf")" ] && { onward=1; break; }
-  sleep 2
-done
-[ -n "$onward" ] || { echo "FAIL — foreign registration did not reach Beoordelen after CBGV-advies" >&2; exit 1; }
-echo "OK — foreign diploma routed through CBGV-advies, then on to Beoordelen (DMN + gateway)"
-
-# ── S-14: escalation. A third registration parks at Beoordelen. We fire its 14-day boundary timer
-# early via Flowable's management API (the timer job is moved to executable and run), which routes a
-# parallel token to the BeoordelingEscaleren external task. The domain's escalation worker acquires
-# it and reassigns the still-open Beoordelen task from the behandelaar group to teamlead (ADR-0015). ─
-echo ">> submitting a third registration to escalate"
-loc3="$(docker run --rm --network "$net" curlimages/curl:latest \
-  -fsS -D - -o /dev/null -X POST "http://$dom_ip:8080/registrations" \
-  -H 'Content-Type: application/json' -d '{"bsn":"123456782"}' \
-  | sed -n 's/\r$//; s/^[Ll]ocation: //p' | head -1)"
-[ -n "$loc3" ] || { echo "FAIL — third POST /registrations returned no Location" >&2; exit 1; }
-reg_id3="${loc3##*/}"
-echo ">> third registration $reg_id3"
-
-# Extracts "<taskId> <processInstanceId>" for a registration from a task-query response on stdin.
-task_and_pid_for_reg() { REG_ID="$1" python3 -c "import os,sys,json
-try:
-    d=json.load(sys.stdin)
-except Exception:
-    d={}
-rid=os.environ['REG_ID']
-t=next((t for t in (d.get('data') or [])
-    if any(v.get('name')=='registrationId' and v.get('value')==rid for v in (t.get('variables') or []))), None)
-print(f\"{t['id']} {t['processInstanceId']}\" if t else '')"; }
-
-# The candidate groups on a task (space-separated, sorted) from a runtime identitylinks response.
-candidate_groups() { python3 -c "import sys,json
-try:
-    links=json.load(sys.stdin)
-except Exception:
-    links=[]
-print(' '.join(sorted(l.get('group') or '' for l in links if l.get('type')=='candidate' and l.get('group'))))"; }
-
-# The first job id in a management jobs/timer-jobs response on stdin.
-first_job_id() { python3 -c "import sys,json
-try:
-    d=json.load(sys.stdin)
-except Exception:
-    d={}
-print(((d.get('data') or [{}])[0]).get('id',''))"; }
-
-echo ">> polling Flowable for its Beoordelen task"
-task_id3=""; pid3=""
-for _ in $(seq 1 30); do
-  resp="$(flcurl -X POST "$fl_base/query/tasks" -H 'Content-Type: application/json' -d "$query" 2>/dev/null || true)"
-  read -r task_id3 pid3 <<<"$(printf '%s' "$resp" | task_and_pid_for_reg "$reg_id3")"
-  [ -n "$task_id3" ] && break
-  sleep 2
-done
-[ -n "$task_id3" ] || { echo "FAIL — no Beoordelen task appeared for registration $reg_id3" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
-echo ">> Beoordelen task $task_id3 (instance $pid3) is waiting for the behandelaar"
-
-echo ">> asserting the task starts out claimable by the behandelaar group"
-before="$(flcurl "$fl_base/runtime/tasks/$task_id3/identitylinks" | candidate_groups)"
-[ "$before" = "behandelaar" ] || { echo "FAIL — expected candidate group 'behandelaar', got '$before'" >&2; exit 1; }
-
-echo ">> firing the 14-day boundary timer early via the management API"
-timer_id="$(flcurl "$fl_base/management/timer-jobs?processInstanceId=$pid3" | first_job_id)"
-[ -n "$timer_id" ] || { echo "FAIL — no timer job found for instance $pid3" >&2; exit 1; }
-# Move the timer job to an executable async job. Flowable's async executor (running in flowable-rest)
-# then picks it up and fires the non-interrupting boundary event. It may run the job before we can
-# look, so executing it explicitly is a best-effort nudge — tolerate the job already being gone.
-flcurl -X POST "$fl_base/management/timer-jobs/$timer_id" -H 'Content-Type: application/json' -d '{"action":"move"}' >/dev/null
-async_id="$(flcurl "$fl_base/management/jobs?processInstanceId=$pid3" 2>/dev/null | first_job_id || true)"
-if [ -n "$async_id" ]; then
-  flcurl -X POST "$fl_base/management/jobs/$async_id" -H 'Content-Type: application/json' -d '{"action":"execute"}' >/dev/null 2>&1 || true
-fi
-echo ">> timer fired; the BeoordelingEscaleren token is parked for the domain worker"
-
-echo ">> polling until the escalation worker reassigns the beoordeling to the teamlead"
-escalated=""
-for _ in $(seq 1 30); do
-  groups="$(flcurl "$fl_base/runtime/tasks/$task_id3/identitylinks" 2>/dev/null | candidate_groups || true)"
-  [ "$groups" = "teamlead" ] && { escalated=1; break; }
-  sleep 2
-done
-[ -n "$escalated" ] || { echo "FAIL — Beoordelen task not reassigned to teamlead (candidate groups: '$groups')" >&2; docker logs "$dom" 2>&1 | tail -15 >&2; exit 1; }
-echo "OK — the 14-day timer escalated the still-open Beoordelen task to the teamlead"
 exit 0

infra/seed-config.sh

@@ -40,7 +40,7 @@ for key in "$@"; do
     oz) populate rr-oz-config "$here/openzaak/setup_configuration/." ;;
     nrc) populate rr-nrc-config "$here/opennotificaties/setup_configuration/." ;;
     kc) populate rr-kc-realms "$here/keycloak/realms/." ;;
-    fl) populate rr-fl-bpmn  "$here/../workflows/." ;;  # registratie.bpmn + diploma-eligibility.dmn
+    fl) populate rr-fl-bpmn  "$here/../workflows/registratie.bpmn" ;;
     *)  echo "unknown seed key: $key" >&2; exit 2 ;;
   esac
 done

libs/api-client/src/lib/generated/bff-api.ts

@@ -192,40 +192,6 @@ export class BffApiV1Service {
     );
   }
 
- postSelfServiceRegistrationsIdWithdraw<TData = void>(id: string, options?: HttpClientBodyOptions): Observable<TData>;
- postSelfServiceRegistrationsIdWithdraw<TData = void>(id: string, options?: HttpClientEventOptions): Observable<HttpEvent<TData>>;
- postSelfServiceRegistrationsIdWithdraw<TData = void>(id: string, options?: HttpClientResponseOptions): Observable<AngularHttpResponse<TData>>;
-  postSelfServiceRegistrationsIdWithdraw<TData = void>(
-    id: string, options?: HttpClientObserveOptions): Observable<TData | HttpEvent<TData> | AngularHttpResponse<TData>> {
-    if (options?.observe === 'events') {
-      return this.http.post<TData>(
-      `/self-service/registrations/${id}/withdraw`,
-      undefined,{
-        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
-        observe: 'events',
-      }
-    );
-    }
-
-    if (options?.observe === 'response') {
-      return this.http.post<TData>(
-      `/self-service/registrations/${id}/withdraw`,
-      undefined,{
-        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
-        observe: 'response',
-      }
-    );
-    }
-
-    return this.http.post<TData>(
-      `/self-service/registrations/${id}/withdraw`,
-      undefined,{
-        ...(options as Omit<NonNullable<typeof options>, 'observe'>),
-        observe: 'body',
-      }
-    );
-  }
-
  getOpenbaarRegister<TData = OpenbaarEntry[]>(params?: GetOpenbaarRegisterParams, options?: HttpClientBodyOptions): Observable<TData>;
  getOpenbaarRegister<TData = OpenbaarEntry[]>(params?: GetOpenbaarRegisterParams, options?: HttpClientEventOptions): Observable<HttpEvent<TData>>;
  getOpenbaarRegister<TData = OpenbaarEntry[]>(params?: GetOpenbaarRegisterParams, options?: HttpClientResponseOptions): Observable<AngularHttpResponse<TData>>;

libs/auth/src/index.ts

@@ -1,6 +1,4 @@
 export * from './lib/auth.service';
 export * from './lib/digid-auth.service';
 export * from './lib/digid-auth.providers';
-export * from './lib/medewerker-auth.service';
-export * from './lib/medewerker-auth.providers';
 export * from './lib/authenticated.guard';

libs/auth/src/lib/auth.service.ts

@@ -1,26 +1,16 @@
-import { signal, Signal } from '@angular/core';
+import { Signal } from '@angular/core';
 
 /**
  * The portal's view of the signed-in user. An abstraction over the OIDC library so components and
- * guards depend on a small, mockable surface (the real implementations are DigiadAuthService for
- * citizens and MedewerkerAuthService for staff).
+ * guards depend on a small, mockable surface (the real implementation is DigiadAuthService).
  */
 export abstract class AuthService {
-  /** Whether a session is active. */
+  /** Whether a DigiD session is active. */
   abstract readonly isAuthenticated: Signal<boolean>;
-  /** The citizen-service number from the DigiD token, once authenticated (staff have none). */
+  /** The citizen-service number from the DigiD token, once authenticated. */
   abstract readonly bsn: Signal<string | undefined>;
-  /**
-   * The realm roles carried in the token. Empty for realms that don't grant roles (e.g. `digid`);
-   * the `medewerker` realm carries `behandelaar`/`teamlead`.
-   */
-  readonly roles: Signal<readonly string[]> = signal<readonly string[]>([]);
-  /** Start login (redirects to Keycloak). */
+  /** Start the DigiD login (redirects to Keycloak). */
   abstract login(): void;
   /** End the session. */
   abstract logout(): void;
-  /** Whether the signed-in user holds the given realm role. */
-  hasRole(role: string): boolean {
-    return this.roles().includes(role);
-  }
 }

libs/auth/src/lib/medewerker-auth.providers.ts

@@ -1,49 +0,0 @@
-import { EnvironmentProviders, makeEnvironmentProviders } from '@angular/core';
-import { LogLevel, provideAuth, withAppInitializerAuthCheck } from 'angular-auth-oidc-client';
-import { AuthService } from './auth.service';
-import { MedewerkerAuthService } from './medewerker-auth.service';
-
-export interface MedewerkerAuthOptions {
-  /** The Keycloak `medewerker` realm issuer, as reachable from the browser. */
-  authority: string;
-  /** Where Keycloak redirects back to after login (usually the app origin). */
-  redirectUrl: string;
-  /**
-   * Route prefixes whose requests get the bearer token attached. The api-client calls the BFF with
-   * **relative** URLs (same-origin via the nginx proxy), so these must be relative path prefixes
-   * (e.g. `/behandel/`) — angular-auth-oidc-client matches `req.url.startsWith(route)`, and a
-   * relative `req.url` never starts with an absolute origin.
-   */
-  secureRoutes: string[];
-}
-
-/**
- * Configure medewerker login (Keycloak `medewerker` realm, public client `big-portal`, auth-code +
- * PKCE) and bind {@link AuthService} to the medewerker-backed implementation. Register
- * {@link authInterceptor} (re-exported from digid-auth.providers) in the app's HttpClient so BFF
- * calls carry the token.
- */
-export function provideMedewerkerAuth(options: MedewerkerAuthOptions): EnvironmentProviders {
-  return makeEnvironmentProviders([
-    provideAuth(
-      {
-        config: {
-          authority: options.authority,
-          redirectUrl: options.redirectUrl,
-          postLogoutRedirectUri: options.redirectUrl,
-          clientId: 'big-portal',
-          scope: 'openid profile',
-          responseType: 'code',
-          silentRenew: true,
-          useRefreshToken: true,
-          secureRoutes: options.secureRoutes,
-          logLevel: LogLevel.Warn,
-        },
-      },
-      // Run checkAuth() at startup so the login callback (?code=…) is processed before the router
-      // and guard run — without it the guard sees "not authenticated" and re-triggers login (loop).
-      withAppInitializerAuthCheck(),
-    ),
-    { provide: AuthService, useClass: MedewerkerAuthService },
-  ]);
-}

libs/auth/src/lib/medewerker-auth.service.spec.ts

@@ -1,43 +0,0 @@
-import { TestBed } from '@angular/core/testing';
-import { OidcSecurityService } from 'angular-auth-oidc-client';
-import { of } from 'rxjs';
-import { MedewerkerAuthService } from './medewerker-auth.service';
-
-function makeService(userData: unknown, authenticated = true) {
-  const oidc = {
-    isAuthenticated$: of({ isAuthenticated: authenticated }),
-    userData$: of({ userData }),
-    authorize: vi.fn(),
-    logoff: vi.fn(() => of(null)),
-  };
-  TestBed.configureTestingModule({
-    providers: [MedewerkerAuthService, { provide: OidcSecurityService, useValue: oidc }],
-  });
-  return { svc: TestBed.inject(MedewerkerAuthService), oidc };
-}
-
-describe('MedewerkerAuthService', () => {
-  it('exposes the realm roles carried in the token', () => {
-    const { svc } = makeService({ realm_access: { roles: ['behandelaar', 'teamlead'] } });
-    expect(svc.roles()).toEqual(['behandelaar', 'teamlead']);
-    expect(svc.hasRole('behandelaar')).toBe(true);
-    expect(svc.hasRole('beheerder')).toBe(false);
-  });
-
-  it('has no roles when the token omits realm_access', () => {
-    const { svc } = makeService({ preferred_username: 'merel-behandelaar' });
-    expect(svc.roles()).toEqual([]);
-    expect(svc.hasRole('behandelaar')).toBe(false);
-  });
-
-  it('reflects the OIDC authenticated state', () => {
-    const { svc } = makeService({}, true);
-    expect(svc.isAuthenticated()).toBe(true);
-  });
-
-  it('starts login by delegating to the OIDC library', () => {
-    const { svc, oidc } = makeService({});
-    svc.login();
-    expect(oidc.authorize).toHaveBeenCalledTimes(1);
-  });
-});

libs/auth/src/lib/medewerker-auth.service.ts

@@ -1,41 +0,0 @@
-import { inject, Injectable, Signal } from '@angular/core';
-import { toSignal } from '@angular/core/rxjs-interop';
-import { OidcSecurityService } from 'angular-auth-oidc-client';
-import { map } from 'rxjs';
-import { AuthService } from './auth.service';
-
-/** The subset of the medewerker token the portal reads: Keycloak nests realm roles here. */
-interface MedewerkerClaims {
-  realm_access?: { roles?: string[] };
-}
-
-/** Medewerker-backed AuthService over angular-auth-oidc-client (Keycloak `medewerker` realm). */
-@Injectable()
-export class MedewerkerAuthService extends AuthService {
-  private readonly oidc = inject(OidcSecurityService);
-
-  readonly isAuthenticated: Signal<boolean> = toSignal(
-    this.oidc.isAuthenticated$.pipe(map((result) => result.isAuthenticated)),
-    { initialValue: false },
-  );
-
-  // Staff have no BSN; the abstract surface keeps this present for the shared guard/interceptor.
-  readonly bsn: Signal<string | undefined> = toSignal(this.oidc.userData$.pipe(map(() => undefined)), {
-    initialValue: undefined,
-  });
-
-  override readonly roles: Signal<readonly string[]> = toSignal(
-    this.oidc.userData$.pipe(
-      map((data) => (data.userData as MedewerkerClaims | null)?.realm_access?.roles ?? []),
-    ),
-    { initialValue: [] },
-  );
-
-  override login(): void {
-    this.oidc.authorize();
-  }
-
-  override logout(): void {
-    this.oidc.logoff().subscribe();
-  }
-}

services/bff/Bff.Api/DownstreamClients.cs

@@ -22,11 +22,6 @@ public interface IDomainClient
 {
     Task<SubmitAccepted> SubmitRegistrationAsync(string bsn, CancellationToken ct = default);
 
-    /// <summary>Withdraw the caller's own registration ("trek aanvraag in"). Owner-scoped by
-    /// <paramref name="bsn"/>. Returns <c>false</c> when the domain reports the registration is
-    /// unknown or not the caller's (404), so the BFF can relay a 404 rather than a 500.</summary>
-    Task<bool> WithdrawRegistrationAsync(string registrationId, string bsn, CancellationToken ct = default);
-
     /// <summary>The behandelaar's werkbak — registrations awaiting beoordeling.</summary>
     Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default);
 
@@ -52,17 +47,6 @@ public sealed class DomainClient(HttpClient http) : IDomainClient
         return new SubmitAccepted(dto.RegistrationId, dto.Status);
     }
 
-    public async Task<bool> WithdrawRegistrationAsync(string registrationId, string bsn, CancellationToken ct = default)
-    {
-        using var response = await http.PostAsJsonAsync(
-            $"registrations/{registrationId}/withdraw", new { bsn }, ct);
-        // The domain 404s an unknown or not-owned registration; relay that rather than fail hard.
-        if (response.StatusCode == System.Net.HttpStatusCode.NotFound)
-            return false;
-        response.EnsureSuccessStatusCode();
-        return true;
-    }
-
     public async Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default)
         => await http.GetFromJsonAsync<List<WerkbakItem>>("behandel/werkbak", ct) ?? [];
 

services/bff/Bff.Api/Program.cs

@@ -86,24 +86,6 @@ app.MapPost("/self-service/registrations", async (ClaimsPrincipal user, IDomainC
     .Produces(StatusCodes.Status400BadRequest)
     .Produces(StatusCodes.Status401Unauthorized);
 
-// Self-service withdrawal (S-11): the signed-in zorgprofessional withdraws their own registration.
-// The bsn comes from the DigiD token and is forwarded to the domain, which owner-scopes the action;
-// a registration that is unknown or not the caller's comes back 404 (ownership is not revealed).
-app.MapPost("/self-service/registrations/{id}/withdraw", async (string id, ClaimsPrincipal user, IDomainClient domain, CancellationToken ct) =>
-{
-    var bsn = user.FindFirstValue("bsn");
-    if (string.IsNullOrWhiteSpace(bsn))
-        return Results.BadRequest("The token carries no bsn claim.");
-
-    var withdrawn = await domain.WithdrawRegistrationAsync(id, bsn, ct);
-    return withdrawn ? Results.NoContent() : Results.NotFound();
-})
-    .RequireAuthorization()
-    .Produces(StatusCodes.Status204NoContent)
-    .Produces(StatusCodes.Status400BadRequest)
-    .Produces(StatusCodes.Status401Unauthorized)
-    .Produces(StatusCodes.Status404NotFound);
-
 // Openbaar register: an anonymous public lookup that exposes only public-safe fields (S-09).
 app.MapGet("/openbaar/register", async (string? q, IProjectionClient projection, CancellationToken ct) =>
 {

services/bff/Bff.Tests/BffFactory.cs

@@ -82,18 +82,6 @@ internal sealed class FakeDomainClient : IDomainClient
         return Task.FromResult(Result);
     }
 
-    public (string RegistrationId, string Bsn)? Withdrawn { get; private set; }
-
-    /// <summary>Whether the fake domain reports the withdrawal as done (true → 204) or not-found/not-owned
-    /// (false → 404). Tests set this to exercise the relay.</summary>
-    public bool WithdrawSucceeds { get; set; } = true;
-
-    public Task<bool> WithdrawRegistrationAsync(string registrationId, string bsn, CancellationToken ct = default)
-    {
-        Withdrawn = (registrationId, bsn);
-        return Task.FromResult(WithdrawSucceeds);
-    }
-
     public (string RegistrationId, string Besluit)? Decided { get; private set; }
 
     public Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default)

services/bff/Bff.Tests/SelfServiceEndpointTests.cs

@@ -71,46 +71,5 @@ public class SelfServiceEndpointTests
         Assert.Equal("reg-123", body!.RegistrationId);
     }
 
-    private static HttpRequestMessage Withdraw(string? bearer, string id = "reg-123")
-    {
-        var request = new HttpRequestMessage(HttpMethod.Post, $"/self-service/registrations/{id}/withdraw");
-        if (bearer is not null)
-            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", bearer);
-        return request;
-    }
-
-    [Fact]
-    public async Task Rejects_a_withdrawal_without_a_token()
-    {
-        using var factory = new BffFactory();
-
-        var response = await factory.CreateClient().SendAsync(Withdraw(bearer: null));
-
-        Assert.Equal(HttpStatusCode.Unauthorized, response.StatusCode);
-        Assert.Null(factory.Domain.Withdrawn);
-    }
-
-    [Fact]
-    public async Task Withdraws_the_callers_registration_forwarding_the_id_and_bsn()
-    {
-        using var factory = new BffFactory();
-
-        var response = await factory.CreateClient().SendAsync(Withdraw(TestTokens.Valid("123456782"), "reg-9"));
-
-        Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);
-        Assert.Equal(("reg-9", "123456782"), factory.Domain.Withdrawn);
-    }
-
-    [Fact]
-    public async Task Relays_not_found_when_the_registration_is_unknown_or_not_the_callers()
-    {
-        using var factory = new BffFactory();
-        factory.Domain.WithdrawSucceeds = false;
-
-        var response = await factory.CreateClient().SendAsync(Withdraw(TestTokens.Valid("123456782")));
-
-        Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
-    }
-
     private sealed record SubmitAcceptedDto(string RegistrationId, string Status);
 }

services/bff/openapi.json

@@ -30,37 +30,6 @@
         }
       }
     },
-    "/self-service/registrations/{id}/withdraw": {
-      "post": {
-        "tags": [
-          "Bff.Api"
-        ],
-        "parameters": [
-          {
-            "name": "id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "204": {
-            "description": "No Content"
-          },
-          "400": {
-            "description": "Bad Request"
-          },
-          "401": {
-            "description": "Unauthorized"
-          },
-          "404": {
-            "description": "Not Found"
-          }
-        }
-      }
-    },
     "/openbaar/register": {
       "get": {
         "tags": [

services/domain/Big.Api/Program.cs

@@ -21,23 +21,17 @@ builder.Services.AddHttpClient<FlowableWorkflowClient>();
 builder.Services.AddTransient<IWorkflowClient>(sp => sp.GetRequiredService<FlowableWorkflowClient>());
 builder.Services.AddTransient<IExternalWorkerClient>(sp => sp.GetRequiredService<FlowableWorkflowClient>());
 builder.Services.AddTransient<IUserTaskClient>(sp => sp.GetRequiredService<FlowableWorkflowClient>());
-builder.Services.AddTransient<IBeoordelingEscalatieClient>(sp => sp.GetRequiredService<FlowableWorkflowClient>());
 builder.Services.AddHttpClient<IAclClient, AclHttpClient>();
 
 builder.Services.AddScoped<SubmitRegistration>();
 builder.Services.AddScoped<ApproveRegistration>();
 builder.Services.AddScoped<BeoordeelRegistratie>();
-builder.Services.AddScoped<WithdrawRegistration>();
 builder.Services.AddScoped<Werkbak>();
 builder.Services.AddScoped<OpenZaakWorker>();
 builder.Services.AddScoped<OpenZaakJobProcessor>();
-builder.Services.AddScoped<BeoordelingEscalatieProcessor>();
 
 // The hosted external-task job worker polls Flowable and drives OpenZaakAanmaken to completion.
 builder.Services.AddHostedService<OpenZaakJobPump>();
-// The escalation worker polls the BeoordelingEscaleren jobs the 14-day timer parks and reassigns
-// each overdue beoordeling to the teamlead (S-14).
-builder.Services.AddHostedService<BeoordelingEscalatiePump>();
 
 var app = builder.Build();
 
@@ -48,12 +42,7 @@ app.MapGet("/health", () => "Healthy");
 // a location to read the registration's progress (ADR-0009, eventual consistency).
 app.MapPost("/registrations", async (SubmitRegistrationRequest body, SubmitRegistration submit, CancellationToken ct) =>
 {
-    // Diploma origin defaults to domestic; a foreign (eIDAS) submission passes "Buitenlands" so the
-    // workflow's DMN routes it through CBGV-advies (S-13). An unknown value is a bad request.
-    if (!Enum.TryParse<DiplomaOrigin>(body.DiplomaOrigin, ignoreCase: true, out var origin) && body.DiplomaOrigin is not null)
-        return Results.BadRequest(new { error = $"Unknown diplomaOrigin '{body.DiplomaOrigin}'. Expected 'Binnenlands' or 'Buitenlands'." });
-
-    var id = await submit.HandleAsync(new SubmitRegistrationCommand(body.Bsn, origin), ct);
+    var id = await submit.HandleAsync(new SubmitRegistrationCommand(body.Bsn), ct);
     return Results.Accepted($"/registrations/{id}", new RegistrationResponse(id.ToString(), RegistrationStatus.Ingediend.ToString(), null));
 });
 
@@ -85,22 +74,6 @@ app.MapPost("/registrations/{id}/decide", async (string id, DecideRequest body,
     return Results.NoContent();
 });
 
-// Withdraw a registration (S-11): the zorgprofessional pulls their own still-open submission back,
-// advancing it to INGETROKKEN and cancelling its workflow. Owner-scoped by the caller's bsn (the BFF
-// forwards it from the DigiD token, S-11c); a registration that is unknown or not the caller's is
-// 404 (indistinguishable, so ownership isn't leaked). Idempotent.
-app.MapPost("/registrations/{id}/withdraw", async (string id, WithdrawRequest body, WithdrawRegistration withdraw, CancellationToken ct) =>
-{
-    if (!Guid.TryParse(id, out var guid))
-        return Results.NotFound();
-
-    if (string.IsNullOrWhiteSpace(body?.Bsn))
-        return Results.BadRequest(new { error = "A bsn is required to withdraw a registration." });
-
-    var outcome = await withdraw.HandleAsync(new WithdrawRegistrationCommand(new RegistrationId(guid), body.Bsn), ct);
-    return outcome == WithdrawOutcome.Withdrawn ? Results.NoContent() : Results.NotFound();
-});
-
 // The behandelaar's werkbak (S-12): the registrations awaiting beoordeling, read from the open
 // Beoordelen user tasks (§8.2) and enriched with bsn + status. The BFF proxies this behind
 // medewerker-realm + behandelaar-role authorization; the domain trusts its callers (§8.3).
@@ -122,12 +95,10 @@ app.MapGet("/registrations/{id}", async (string id, IRegistrationStore store, Ca
 
 await app.RunAsync();
 
-public sealed record SubmitRegistrationRequest(string Bsn, string? DiplomaOrigin = null);
+public sealed record SubmitRegistrationRequest(string Bsn);
 
 public sealed record DecideRequest(string Besluit);
 
-public sealed record WithdrawRequest(string Bsn);
-
 public sealed record RegistrationResponse(string RegistrationId, string Status, string? ZaakUrl);
 
 public partial class Program;

services/domain/Big.Application/Ports.cs

@@ -11,20 +11,10 @@ public interface IWorkflowClient
 {
     /// <summary>
     /// Start one <c>registratie</c> process instance for the given registration, carrying the
-    /// registration id (so the <c>OpenZaakAanmaken</c> external task can be correlated back to its
-    /// aggregate) and the diploma origin (so the workflow's DMN can route foreign diplomas through
-    /// CBGV-advies, S-13). Returns the process instance id.
+    /// registration id so the <c>OpenZaakAanmaken</c> external task can be correlated back to its
+    /// aggregate. Returns the process instance id.
     /// </summary>
-    Task<string> StartRegistrationProcessAsync(
-        RegistrationId registrationId, DiplomaOrigin diplomaOrigin, CancellationToken ct = default);
-
-    /// <summary>
-    /// Cancel a running <c>registratie</c> process on withdrawal (S-11): correlate the
-    /// <c>RegistratieIngetrokken</c> message to the instance, tripping the interrupting message event
-    /// that ends it (ADR-0014). Best-effort — if the instance is not waiting on that message (already
-    /// ended, or not yet parked) it is a no-op; the aggregate is INGETROKKEN regardless.
-    /// </summary>
-    Task WithdrawProcessAsync(string processInstanceId, CancellationToken ct = default);
+    Task<string> StartRegistrationProcessAsync(RegistrationId registrationId, CancellationToken ct = default);
 }
 
 /// <summary>
@@ -88,10 +78,3 @@ public interface IRegistrationStore
 /// it) and the registration id it carries as a process variable.
 /// </summary>
 public sealed record OpenZaakJob(string JobId, RegistrationId RegistrationId);
-
-/// <summary>
-/// An acquired <c>BeoordelingEscaleren</c> escalation job (S-14): the Flowable job id and the process
-/// instance whose still-open <c>Beoordelen</c> task must be reassigned from behandelaar to teamlead
-/// once the 14-day boundary timer fires (ADR-0015).
-/// </summary>
-public sealed record EscalatieJob(string JobId, string ProcessInstanceId);

services/domain/Big.Application/SubmitRegistration.cs

@@ -2,10 +2,8 @@ using Big.Domain;
 
 namespace Big.Application;
 
-/// <summary>A zorgprofessional's request to register, in domain language. No ZGW concepts. The
-/// diploma origin defaults to domestic (the DigiD path); a foreign (eIDAS) submission sets it to
-/// <see cref="DiplomaOrigin.Buitenlands"/> so the workflow's DMN routes it through CBGV-advies (S-13).</summary>
-public sealed record SubmitRegistrationCommand(string Bsn, DiplomaOrigin DiplomaOrigin = DiplomaOrigin.Binnenlands);
+/// <summary>A zorgprofessional's request to register, in domain language. No ZGW concepts.</summary>
+public sealed record SubmitRegistrationCommand(string Bsn);
 
 /// <summary>
 /// The submit use case: create the <see cref="Registration"/> aggregate (INGEDIEND), persist it,
@@ -20,14 +18,13 @@ public sealed class SubmitRegistration(IRegistrationStore store, IWorkflowClient
     {
         ArgumentNullException.ThrowIfNull(command);
 
-        var registration = Registration.Submit(command.Bsn, command.DiplomaOrigin);
+        var registration = Registration.Submit(command.Bsn);
 
         // Persist before starting the process so the worker can correlate the OpenZaakAanmaken
         // job back to an aggregate that already exists (ADR-0009).
         await store.SaveAsync(registration, ct);
 
-        var processInstanceId = await workflow.StartRegistrationProcessAsync(
-            registration.Id, registration.DiplomaOrigin, ct);
+        var processInstanceId = await workflow.StartRegistrationProcessAsync(registration.Id, ct);
         registration.RecordProcessStarted(processInstanceId);
         await store.SaveAsync(registration, ct);
 

services/domain/Big.Application/Werkbak.cs

@@ -1,5 +1,3 @@
-using Big.Domain;
-
 namespace Big.Application;
 
 /// <summary>One row of the behandelaar's werkbak: a registration awaiting beoordeling, with the
@@ -10,8 +8,7 @@ public sealed record WerkbakItem(string RegistrationId, string Bsn, string Statu
 /// The werkbak query (S-12c): the registrations awaiting a behandelaar's beoordeling. It reads the
 /// open <c>Beoordelen</c> tasks from the workflow engine (§8.2, via <see cref="IUserTaskClient"/>) —
 /// the authoritative set of work items — and enriches each with its aggregate (bsn + status). A task
-/// whose registration the domain doesn't know, or whose registration is no longer open for beoordeling
-/// (e.g. withdrawn — S-11 — while its task lingers until the workflow cancels it), is skipped.
+/// whose registration the domain doesn't know is skipped rather than invented.
 /// </summary>
 public sealed class Werkbak(IUserTaskClient tasks, IRegistrationStore store)
 {
@@ -23,7 +20,7 @@ public sealed class Werkbak(IUserTaskClient tasks, IRegistrationStore store)
         foreach (var task in open)
         {
             var registration = await store.GetAsync(task.RegistrationId, ct);
-            if (registration is null || !IsOpenForBeoordeling(registration.Status))
+            if (registration is null)
                 continue;
 
             items.Add(new WerkbakItem(
@@ -32,9 +29,4 @@ public sealed class Werkbak(IUserTaskClient tasks, IRegistrationStore store)
 
         return items;
     }
-
-    // Only registrations still open for a decision belong in the werkbak; a terminal one (decided or
-    // withdrawn — S-11) whose Beoordelen task has not yet been cleared must not surface to a behandelaar.
-    private static bool IsOpenForBeoordeling(RegistrationStatus status)
-        => status is RegistrationStatus.Ingediend or RegistrationStatus.InBehandeling;
 }

services/domain/Big.Application/WithdrawRegistration.cs

@@ -1,55 +0,0 @@
-using Big.Domain;
-
-namespace Big.Application;
-
-/// <summary>A zorgprofessional's request to withdraw their own registration ("trek aanvraag in").
-/// <paramref name="Bsn"/> is the authenticated caller (from the DigiD token, forwarded by the BFF):
-/// only the registration's own bsn may withdraw it.</summary>
-public sealed record WithdrawRegistrationCommand(RegistrationId RegistrationId, string Bsn);
-
-/// <summary>The outcome of a withdrawal request.</summary>
-public enum WithdrawOutcome
-{
-    /// <summary>The registration is now (or already was) INGETROKKEN.</summary>
-    Withdrawn,
-
-    /// <summary>No registration with that id belongs to the caller — unknown, or owned by someone
-    /// else (the two are deliberately indistinguishable, so the endpoint reveals neither).</summary>
-    NotFound,
-}
-
-/// <summary>
-/// The withdrawal use case (S-11): a zorgprofessional pulls a still-open registration back. It
-/// advances the aggregate to INGETROKKEN, persists it, then cancels the running registratie process
-/// by correlating the withdrawal message to its instance (ADR-0014), so the case leaves the
-/// behandelaar's werkbak. Idempotent — a repeated or redelivered withdrawal of an already-withdrawn
-/// registration is a no-op (not persisted or cancelled again). Cancelling is best-effort: if the
-/// registration never started a process the withdrawal still stands (the process cancel is skipped),
-/// mirroring how <see cref="BeoordeelRegistratie"/> completes its task best-effort.
-/// </summary>
-public sealed class WithdrawRegistration(IRegistrationStore store, IWorkflowClient workflow)
-{
-    public async Task<WithdrawOutcome> HandleAsync(WithdrawRegistrationCommand command, CancellationToken ct = default)
-    {
-        ArgumentNullException.ThrowIfNull(command);
-
-        var registration = await store.GetAsync(command.RegistrationId, ct);
-
-        // Unknown, or not the caller's registration: report NotFound either way (don't reveal which).
-        if (registration is null || registration.Bsn != command.Bsn)
-            return WithdrawOutcome.NotFound;
-
-        // A repeated withdrawal is a no-op: don't persist or cancel the already-withdrawn one again.
-        if (registration.Status == RegistrationStatus.Ingetrokken)
-            return WithdrawOutcome.Withdrawn;
-
-        registration.Withdraw();
-        await store.SaveAsync(registration, ct);
-
-        // Cancel the running process (if one was started) so its Beoordelen task leaves the werkbak.
-        if (registration.ProcessInstanceId is not null)
-            await workflow.WithdrawProcessAsync(registration.ProcessInstanceId, ct);
-
-        return WithdrawOutcome.Withdrawn;
-    }
-}

services/domain/Big.Domain/DiplomaOrigin.cs

@@ -1,17 +0,0 @@
-namespace Big.Domain;
-
-/// <summary>
-/// Where a zorgprofessional's diploma was issued. It is the input to the diploma-eligibility decision
-/// (S-13): a <see cref="Buitenlands"/> (foreign) diploma routes the registratie through an extra
-/// CBGV-advies assessment step, a <see cref="Binnenlands"/> (domestic) one goes straight to beoordeling.
-/// The decision itself lives in the workflow's DMN, not here (ADR-0016); the domain only carries the
-/// origin and hands it to the process as a start variable.
-/// </summary>
-public enum DiplomaOrigin
-{
-    /// <summary>A Dutch (domestic) diploma. Default for a registration submitted via DigiD.</summary>
-    Binnenlands,
-
-    /// <summary>A foreign diploma (e.g. an eIDAS submission). Triggers the CBGV-advies step.</summary>
-    Buitenlands,
-}

services/domain/Big.Domain/Registration.cs

@@ -7,11 +7,10 @@ namespace Big.Domain;
 /// </summary>
 public sealed class Registration
 {
-    private Registration(RegistrationId id, string bsn, DiplomaOrigin diplomaOrigin)
+    private Registration(RegistrationId id, string bsn)
     {
         Id = id;
         Bsn = bsn;
-        DiplomaOrigin = diplomaOrigin;
         Status = RegistrationStatus.Ingediend;
     }
 
@@ -21,10 +20,6 @@ public sealed class Registration
     /// as the domain payload; the domain never constructs ZGW concepts from it (§8.1).</summary>
     public string Bsn { get; }
 
-    /// <summary>Where the diploma was issued. Rides along to the process as a start variable and
-    /// drives the diploma-eligibility DMN's foreign→CBGV-advies routing (S-13, ADR-0016).</summary>
-    public DiplomaOrigin DiplomaOrigin { get; }
-
     public RegistrationStatus Status { get; private set; }
 
     /// <summary>The Flowable process instance driving this registration, once started.</summary>
@@ -33,13 +28,11 @@ public sealed class Registration
     /// <summary>The zaak the ACL opened for this registration, once the external task has run.</summary>
     public Uri? ZaakUrl { get; private set; }
 
-    /// <summary>Submit a new registration. It begins in <see cref="RegistrationStatus.Ingediend"/>.
-    /// The diploma origin defaults to <see cref="DiplomaOrigin.Binnenlands"/> — the common DigiD path;
-    /// a foreign (eIDAS) submission passes <see cref="DiplomaOrigin.Buitenlands"/>.</summary>
-    public static Registration Submit(string bsn, DiplomaOrigin diplomaOrigin = DiplomaOrigin.Binnenlands)
+    /// <summary>Submit a new registration. It begins in <see cref="RegistrationStatus.Ingediend"/>.</summary>
+    public static Registration Submit(string bsn)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(bsn);
-        return new Registration(RegistrationId.New(), bsn, diplomaOrigin);
+        return new Registration(RegistrationId.New(), bsn);
     }
 
     /// <summary>Record that the registratie workflow process has been started for this registration.</summary>
@@ -118,23 +111,7 @@ public sealed class Registration
         Status = RegistrationStatus.Afgewezen;
     }
 
-    /// <summary>
-    /// Withdraw the registration — the zorgprofessional pulls their own submission back (S-11). Allowed
-    /// while it is still open (INGEDIEND or IN_BEHANDELING) and needs no zaak; a registration that has
-    /// already been decided (INGESCHREVEN/AFGEWEZEN) can no longer be withdrawn. Re-withdrawing one
-    /// already <see cref="RegistrationStatus.Ingetrokken"/> is a no-op.
-    /// </summary>
-    public void Withdraw()
-    {
-        if (Status == RegistrationStatus.Ingetrokken)
-            return;
-
-        RequireOpenForDecision(nameof(Withdraw));
-        Status = RegistrationStatus.Ingetrokken;
-    }
-
-    // A decision (or withdrawal) is only valid while the registration is still open (INGEDIEND or
-    // IN_BEHANDELING).
+    // A decision is only valid while the registration is still open (INGEDIEND or IN_BEHANDELING).
     private void RequireOpenForDecision(string decision)
     {
         if (Status is not (RegistrationStatus.Ingediend or RegistrationStatus.InBehandeling))

services/domain/Big.Domain/RegistrationStatus.cs

@@ -3,8 +3,7 @@ namespace Big.Domain;
 /// <summary>The lifecycle states a <see cref="Registration"/> moves through. Submission starts in
 /// <see cref="Ingediend"/>; a behandelaar takes it <see cref="InBehandeling"/> and decides it into one
 /// of the terminal states <see cref="Ingeschreven"/> (approved) or <see cref="Afgewezen"/> (rejected).
-/// A zorgprofessional can withdraw a still-open registration into <see cref="Ingetrokken"/> (S-11).
-/// The herregistratie state arrives in its own slice.</summary>
+/// Withdrawal and herregistratie states arrive in their own slices (S-11+).</summary>
 public enum RegistrationStatus
 {
     /// <summary>Submitted by the zorgprofessional; the registratie process has been started.</summary>
@@ -18,7 +17,4 @@ public enum RegistrationStatus
 
     /// <summary>Rejected by the behandelaar. Terminal.</summary>
     Afgewezen,
-
-    /// <summary>Withdrawn by the zorgprofessional before a decision (S-11). Terminal.</summary>
-    Ingetrokken,
 }

services/domain/Big.Infrastructure/BeoordelingEscalatieProcessor.cs

@@ -1,37 +0,0 @@
-using Microsoft.Extensions.Logging;
-
-namespace Big.Infrastructure;
-
-/// <summary>
-/// One poll tick of the beoordeling-escalation worker (S-14, ADR-0015): acquire the parked
-/// <c>BeoordelingEscaleren</c> jobs — the tokens the 14-day boundary timer on <c>Beoordelen</c> spawns
-/// — reassign each instance's still-open <c>Beoordelen</c> task to the teamlead, and complete the job.
-/// A job that fails is logged and left un-completed so Flowable redelivers it (§8.6). Split out from
-/// the hosted pump so the acquire→reassign→complete logic is unit-testable without a running host.
-/// </summary>
-public sealed class BeoordelingEscalatieProcessor(
-    IBeoordelingEscalatieClient client,
-    ILogger<BeoordelingEscalatieProcessor> logger)
-{
-    /// <summary>Acquire and process up to <paramref name="maxJobs"/> escalations. Returns the number acquired.</summary>
-    public async Task<int> PumpOnceAsync(int maxJobs, CancellationToken ct = default)
-    {
-        var jobs = await client.AcquireBeoordelingEscalatieJobsAsync(maxJobs, ct);
-
-        foreach (var job in jobs)
-        {
-            try
-            {
-                await client.ReassignBeoordelingToTeamleadAsync(job.ProcessInstanceId, ct);
-                await client.CompleteBeoordelingEscalatieJobAsync(job.JobId, ct);
-            }
-            catch (Exception ex)
-            {
-                // Leave the job un-completed: its lock expires and Flowable redelivers it (§8.6).
-                logger.LogError(ex, "BeoordelingEscaleren job {JobId} failed; leaving it for redelivery.", job.JobId);
-            }
-        }
-
-        return jobs.Count;
-    }
-}

services/domain/Big.Infrastructure/BeoordelingEscalatiePump.cs

@@ -1,49 +0,0 @@
-using Microsoft.Extensions.DependencyInjection;
-using Microsoft.Extensions.Hosting;
-using Microsoft.Extensions.Logging;
-
-namespace Big.Infrastructure;
-
-/// <summary>
-/// The hosted polling loop of the beoordeling-escalation worker (S-14, ADR-0015): on an interval it
-/// resolves a scoped <see cref="BeoordelingEscalatieProcessor"/> and asks it to drain the parked
-/// <c>BeoordelingEscaleren</c> jobs. A deliberately thin shell — all acquire/reassign/complete logic
-/// lives in the processor, which is unit-tested; this class only owns the timer, the per-tick scope,
-/// and loop resilience. Structurally identical to <see cref="OpenZaakJobPump"/>.
-/// </summary>
-public sealed class BeoordelingEscalatiePump(
-    IServiceScopeFactory scopeFactory,
-    FlowableOptions options,
-    ILogger<BeoordelingEscalatiePump> logger) : BackgroundService
-{
-    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
-    {
-        while (!stoppingToken.IsCancellationRequested)
-        {
-            try
-            {
-                using var scope = scopeFactory.CreateScope();
-                var processor = scope.ServiceProvider.GetRequiredService<BeoordelingEscalatieProcessor>();
-                await processor.PumpOnceAsync(options.MaxJobsPerPoll, stoppingToken);
-            }
-            catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
-            {
-                break;
-            }
-            catch (Exception ex)
-            {
-                // A transient fault (e.g. Flowable briefly unreachable) must not kill the loop.
-                logger.LogError(ex, "BeoordelingEscaleren job poll failed; retrying after the poll interval.");
-            }
-
-            try
-            {
-                await Task.Delay(options.PollInterval, stoppingToken);
-            }
-            catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
-            {
-                break;
-            }
-        }
-    }
-}

services/domain/Big.Infrastructure/FlowableWorkflowClient.cs

@@ -15,29 +15,20 @@ namespace Big.Infrastructure;
 /// The REST contract here is the one verified against a live flowable-rest engine (ADR-0009).
 /// </summary>
 public sealed class FlowableWorkflowClient(HttpClient http, FlowableOptions options)
-    : IWorkflowClient, IExternalWorkerClient, IUserTaskClient, IBeoordelingEscalatieClient
+    : IWorkflowClient, IExternalWorkerClient, IUserTaskClient
 {
     private const string Topic = "OpenZaakAanmaken";
-    private const string EscalatieTopic = "BeoordelingEscaleren";
     private const string ProcessDefinitionKey = "registratie";
     private const string BeoordelenTaskKey = "Beoordelen";
-    private const string BehandelaarGroup = "behandelaar";
-    private const string TeamleadGroup = "teamlead";
     private const string RegistrationIdVariable = "registrationId";
-    private const string DiplomaOriginVariable = "diplomaOrigin";
     private const string ZaakUrlVariable = "zaakUrl";
     private const string BesluitVariable = "besluit";
-    private const string IngetrokkenMessage = "RegistratieIngetrokken";
 
-    public async Task<string> StartRegistrationProcessAsync(
-        RegistrationId registrationId, DiplomaOrigin diplomaOrigin, CancellationToken ct = default)
+    public async Task<string> StartRegistrationProcessAsync(RegistrationId registrationId, CancellationToken ct = default)
     {
         var request = new StartProcessRequest(
             ProcessDefinitionKey,
-            [
-                new Variable(RegistrationIdVariable, "string", registrationId.ToString()),
-                new Variable(DiplomaOriginVariable, "string", diplomaOrigin.ToString()),
-            ]);
+            [new Variable(RegistrationIdVariable, "string", registrationId.ToString())]);
 
         var created = await PostAsync<StartProcessRequest, ProcessInstance>(
             "service/runtime/process-instances", request, ct)
@@ -94,84 +85,6 @@ public sealed class FlowableWorkflowClient(HttpClient http, FlowableOptions opti
         response.EnsureSuccessStatusCode();
     }
 
-    public async Task WithdrawProcessAsync(string processInstanceId, CancellationToken ct = default)
-    {
-        // Correlate the withdrawal message to the instance: find the execution subscribed to it (the
-        // interrupting message event's own execution — NOT the user task's), then deliver
-        // messageEventReceived to that execution so the process ends (ADR-0014). If nothing is
-        // subscribed (the process is not parked at Beoordelen) this is a best-effort no-op.
-        var subscribed = await GetAsync<ExecutionQueryResult>(
-            $"service/runtime/executions?messageEventSubscriptionName={IngetrokkenMessage}&processInstanceId={processInstanceId}",
-            ct);
-
-        var execution = subscribed?.Data?.FirstOrDefault();
-        if (execution is null)
-            return;
-
-        var request = new MessageEventRequest("messageEventReceived", IngetrokkenMessage);
-        using var response = await SendAsync(
-            $"service/runtime/executions/{execution.Id}", request, ct, HttpMethod.Put);
-        response.EnsureSuccessStatusCode();
-    }
-
-    public async Task<IReadOnlyList<EscalatieJob>> AcquireBeoordelingEscalatieJobsAsync(int maxJobs, CancellationToken ct = default)
-    {
-        var request = new AcquireJobsRequest(EscalatieTopic, options.LockDuration, maxJobs, options.WorkerId);
-
-        var jobs = await PostAsync<AcquireJobsRequest, List<AcquiredEscalatieJob>>(
-            "external-job-api/acquire/jobs", request, ct) ?? [];
-
-        return [.. jobs.Select(job => new EscalatieJob(job.Id, job.ProcessInstanceId))];
-    }
-
-    public async Task ReassignBeoordelingToTeamleadAsync(string processInstanceId, CancellationToken ct = default)
-    {
-        // The escalation token runs in parallel to the still-open Beoordelen task (non-interrupting
-        // boundary timer); find that task in this instance so we can move it to the teamlead. If the
-        // behandelaar completed it just before the timer fired there is nothing to reassign — a
-        // best-effort no-op (the timer/completion race, cf. §8.6).
-        var query = new TaskByInstanceQueryRequest(processInstanceId, BeoordelenTaskKey);
-        var page = await PostAsync<TaskByInstanceQueryRequest, TaskQueryResult>(
-            "service/query/tasks", query, ct);
-
-        var task = page?.Data?.FirstOrDefault();
-        if (task is null)
-            return;
-
-        // Add teamlead, then drop behandelaar: the task now belongs to the teamlead group.
-        using (var added = await SendAsync(
-            $"service/runtime/tasks/{task.Id}/identitylinks",
-            new IdentityLinkRequest(TeamleadGroup, "candidate"), ct))
-            added.EnsureSuccessStatusCode();
-
-        await DeleteAsync(
-            $"service/runtime/tasks/{task.Id}/identitylinks/groups/{BehandelaarGroup}/candidate", ct);
-    }
-
-    public async Task CompleteBeoordelingEscalatieJobAsync(string jobId, CancellationToken ct = default)
-    {
-        using var response = await SendAsync(
-            $"external-job-api/acquire/jobs/{jobId}/complete", new CompleteJobRequest(options.WorkerId, []), ct);
-        response.EnsureSuccessStatusCode();
-    }
-
-    private async Task<TResponse?> GetAsync<TResponse>(string path, CancellationToken ct)
-    {
-        var message = new HttpRequestMessage(HttpMethod.Get, new Uri(options.BaseUrl, path));
-        message.Headers.Authorization = new AuthenticationHeaderValue("Basic", BasicCredentials());
-        using var response = await http.SendAsync(message, ct);
-        response.EnsureSuccessStatusCode();
-        return await response.Content.ReadFromJsonAsync<TResponse>(ct);
-    }
-
-    private async Task DeleteAsync(string path, CancellationToken ct)
-    {
-        var message = new HttpRequestMessage(HttpMethod.Delete, new Uri(options.BaseUrl, path));
-        message.Headers.Authorization = new AuthenticationHeaderValue("Basic", BasicCredentials());
-        using var response = await http.SendAsync(message, ct);
-        response.EnsureSuccessStatusCode();
-    }
-
     private async Task<TResponse?> PostAsync<TRequest, TResponse>(string path, TRequest body, CancellationToken ct)
     {
         using var response = await SendAsync(path, body, ct);
@@ -179,9 +92,9 @@ public sealed class FlowableWorkflowClient(HttpClient http, FlowableOptions opti
         return await response.Content.ReadFromJsonAsync<TResponse>(ct);
     }
 
-    private Task<HttpResponseMessage> SendAsync<TRequest>(string path, TRequest body, CancellationToken ct, HttpMethod? method = null)
+    private Task<HttpResponseMessage> SendAsync<TRequest>(string path, TRequest body, CancellationToken ct)
     {
-        var message = new HttpRequestMessage(method ?? HttpMethod.Post, new Uri(options.BaseUrl, path))
+        var message = new HttpRequestMessage(HttpMethod.Post, new Uri(options.BaseUrl, path))
         {
             Content = JsonContent.Create(body),
         };
@@ -211,14 +124,6 @@ public sealed class FlowableWorkflowClient(HttpClient http, FlowableOptions opti
         [property: JsonPropertyName("taskDefinitionKey")] string TaskDefinitionKey,
         [property: JsonPropertyName("includeProcessVariables")] bool IncludeProcessVariables);
 
-    private sealed record TaskByInstanceQueryRequest(
-        [property: JsonPropertyName("processInstanceId")] string ProcessInstanceId,
-        [property: JsonPropertyName("taskDefinitionKey")] string TaskDefinitionKey);
-
-    private sealed record IdentityLinkRequest(
-        [property: JsonPropertyName("group")] string Group,
-        [property: JsonPropertyName("type")] string Type);
-
     private sealed record ClaimTaskRequest(
         [property: JsonPropertyName("action")] string Action,
         [property: JsonPropertyName("assignee")] string Assignee);
@@ -227,10 +132,6 @@ public sealed class FlowableWorkflowClient(HttpClient http, FlowableOptions opti
         [property: JsonPropertyName("action")] string Action,
         [property: JsonPropertyName("variables")] IReadOnlyList<Variable> Variables);
 
-    private sealed record MessageEventRequest(
-        [property: JsonPropertyName("action")] string Action,
-        [property: JsonPropertyName("messageName")] string MessageName);
-
     private sealed record TaskQueryResult(
         [property: JsonPropertyName("data")] IReadOnlyList<UserTaskDto>? Data);
 
@@ -253,15 +154,6 @@ public sealed class FlowableWorkflowClient(HttpClient http, FlowableOptions opti
 
     private sealed record ProcessInstance([property: JsonPropertyName("id")] string Id);
 
-    private sealed record ExecutionQueryResult(
-        [property: JsonPropertyName("data")] IReadOnlyList<ExecutionDto>? Data);
-
-    private sealed record ExecutionDto([property: JsonPropertyName("id")] string Id);
-
-    private sealed record AcquiredEscalatieJob(
-        [property: JsonPropertyName("id")] string Id,
-        [property: JsonPropertyName("processInstanceId")] string ProcessInstanceId);
-
     private sealed record AcquiredJob(
         [property: JsonPropertyName("id")] string Id,
         [property: JsonPropertyName("variables")] IReadOnlyList<Variable> Variables)

services/domain/Big.Infrastructure/IExternalWorkerClient.cs

@@ -16,23 +16,3 @@ public interface IExternalWorkerClient
     /// <summary>Complete an acquired job, passing the opened zaak URL back into the process.</summary>
     Task CompleteOpenZaakJobAsync(string jobId, Uri zaakUrl, CancellationToken ct = default);
 }
-
-/// <summary>
-/// The escalation side of the Workflow Client (S-14): the <c>BeoordelingEscaleren</c> external-worker
-/// jobs parked by the 14-day boundary timer on <c>Beoordelen</c>, and the reassignment they drive.
-/// Kept separate from <see cref="IExternalWorkerClient"/> (interface segregation) so the OpenZaak
-/// worker never sees escalation. Implemented by <see cref="FlowableWorkflowClient"/> — the only code
-/// that talks to Flowable (§8.2, ADR-0015).
-/// </summary>
-public interface IBeoordelingEscalatieClient
-{
-    /// <summary>Acquire and lock up to <paramref name="maxJobs"/> <c>BeoordelingEscaleren</c> jobs.</summary>
-    Task<IReadOnlyList<EscalatieJob>> AcquireBeoordelingEscalatieJobsAsync(int maxJobs, CancellationToken ct = default);
-
-    /// <summary>Reassign the still-open <c>Beoordelen</c> task in the given process instance from the
-    /// behandelaar group to teamlead. Best-effort no-op if the task is no longer open.</summary>
-    Task ReassignBeoordelingToTeamleadAsync(string processInstanceId, CancellationToken ct = default);
-
-    /// <summary>Complete an acquired escalation job so its token reaches the escalation end event.</summary>
-    Task CompleteBeoordelingEscalatieJobAsync(string jobId, CancellationToken ct = default);
-}

services/domain/Big.Tests/BeoordelingEscalatieProcessorTests.cs

@@ -1,82 +0,0 @@
-using Big.Application;
-using Big.Infrastructure;
-using Microsoft.Extensions.Logging;
-using Microsoft.Extensions.Logging.Abstractions;
-
-namespace Big.Tests;
-
-// S-14 (#15): the escalation drain loop. Mirrors OpenZaakJobProcessor — acquire the parked
-// BeoordelingEscaleren jobs, reassign each instance's Beoordelen task to teamlead, then complete the
-// job. A job whose reassignment fails is logged and left un-completed for Flowable to redeliver (§8.6).
-public class BeoordelingEscalatieProcessorTests
-{
-    /// <summary>A fake escalation client: scripts the jobs to acquire, records reassignments and
-    /// completions, and can be told to throw on reassigning a given instance.</summary>
-    private sealed class FakeEscalatieClient(params EscalatieJob[] jobs) : IBeoordelingEscalatieClient
-    {
-        public int AcquireCount { get; private set; }
-        public List<string> Reassigned { get; } = [];
-        public List<string> Completed { get; } = [];
-        public string? ThrowOnInstance { get; set; }
-
-        public Task<IReadOnlyList<EscalatieJob>> AcquireBeoordelingEscalatieJobsAsync(int maxJobs, CancellationToken ct = default)
-        {
-            AcquireCount++;
-            return Task.FromResult<IReadOnlyList<EscalatieJob>>(jobs.Take(maxJobs).ToList());
-        }
-
-        public Task ReassignBeoordelingToTeamleadAsync(string processInstanceId, CancellationToken ct = default)
-        {
-            if (processInstanceId == ThrowOnInstance)
-                throw new InvalidOperationException("reassign failed");
-            Reassigned.Add(processInstanceId);
-            return Task.CompletedTask;
-        }
-
-        public Task CompleteBeoordelingEscalatieJobAsync(string jobId, CancellationToken ct = default)
-        {
-            Completed.Add(jobId);
-            return Task.CompletedTask;
-        }
-    }
-
-    [Fact]
-    public async Task Acquires_an_escalation_reassigns_to_teamlead_and_completes_the_job()
-    {
-        var client = new FakeEscalatieClient(new EscalatieJob("job-9", "pi-1"));
-
-        var acquired = await new BeoordelingEscalatieProcessor(
-            client, NullLogger<BeoordelingEscalatieProcessor>.Instance).PumpOnceAsync(5);
-
-        Assert.Equal(1, acquired);
-        Assert.Equal("pi-1", Assert.Single(client.Reassigned));
-        Assert.Equal("job-9", Assert.Single(client.Completed));
-    }
-
-    [Fact]
-    public async Task A_failing_reassign_is_left_uncompleted_for_flowable_to_redeliver()
-    {
-        var client = new FakeEscalatieClient(new EscalatieJob("job-9", "pi-1")) { ThrowOnInstance = "pi-1" };
-        var logger = new CapturingLogger<BeoordelingEscalatieProcessor>();
-
-        var acquired = await new BeoordelingEscalatieProcessor(client, logger).PumpOnceAsync(5);
-
-        Assert.Equal(1, acquired);
-        Assert.Empty(client.Completed);
-        var error = Assert.Single(logger.Entries, e => e.Level == LogLevel.Error);
-        Assert.Contains("job-9", error.Message);
-    }
-
-    [Fact]
-    public async Task Does_nothing_but_poll_when_there_are_no_escalations()
-    {
-        var client = new FakeEscalatieClient();
-
-        var acquired = await new BeoordelingEscalatieProcessor(
-            client, NullLogger<BeoordelingEscalatieProcessor>.Instance).PumpOnceAsync(5);
-
-        Assert.Equal(0, acquired);
-        Assert.Equal(1, client.AcquireCount);
-        Assert.Empty(client.Completed);
-    }
-}

services/domain/Big.Tests/Fakes.cs

@@ -32,23 +32,13 @@ internal sealed class FakeWorkflowClient(string processInstanceId = "proc-1", Ac
     : IWorkflowClient
 {
     public RegistrationId? StartedFor { get; private set; }
-    public DiplomaOrigin? StartedWithOrigin { get; private set; }
-    public string? WithdrawnProcessInstanceId { get; private set; }
 
-    public Task<string> StartRegistrationProcessAsync(
-        RegistrationId registrationId, DiplomaOrigin diplomaOrigin, CancellationToken ct = default)
+    public Task<string> StartRegistrationProcessAsync(RegistrationId registrationId, CancellationToken ct = default)
     {
         onStart?.Invoke(registrationId);
         StartedFor = registrationId;
-        StartedWithOrigin = diplomaOrigin;
         return Task.FromResult(processInstanceId);
     }
-
-    public Task WithdrawProcessAsync(string processInstanceId, CancellationToken ct = default)
-    {
-        WithdrawnProcessInstanceId = processInstanceId;
-        return Task.CompletedTask;
-    }
 }
 
 /// <summary>A fake user-task client for the werkbak/decision use cases: returns a scripted set of

services/domain/Big.Tests/FlowableWorkflowClientTests.cs

@@ -24,7 +24,7 @@ public class FlowableWorkflowClientTests
         var client = Client(capture.Responds(HttpStatusCode.Created, """{"id":"pi-1"}"""));
         var rid = RegistrationId.New();
 
-        var pid = await client.StartRegistrationProcessAsync(rid, DiplomaOrigin.Binnenlands);
+        var pid = await client.StartRegistrationProcessAsync(rid);
 
         Assert.Equal("pi-1", pid);
         Assert.Equal(HttpMethod.Post, capture.Seen!.Method);
@@ -38,22 +38,6 @@ public class FlowableWorkflowClientTests
         Assert.Contains($"\"value\":\"{rid}\"", capture.Body);
     }
 
-    [Theory]
-    [InlineData(DiplomaOrigin.Binnenlands, "Binnenlands")]
-    [InlineData(DiplomaOrigin.Buitenlands, "Buitenlands")]
-    public async Task Start_posts_the_diploma_origin_as_a_process_variable(DiplomaOrigin origin, string expected)
-    {
-        // The diploma origin rides along as a start variable so the workflow's DMN can route foreign
-        // diplomas through CBGV-advies (S-13, ADR-0016).
-        var capture = new RequestCapture();
-        var client = Client(capture.Responds(HttpStatusCode.Created, """{"id":"pi-1"}"""));
-
-        await client.StartRegistrationProcessAsync(RegistrationId.New(), origin);
-
-        Assert.Contains("\"name\":\"diplomaOrigin\"", capture.Body);
-        Assert.Contains($"\"value\":\"{expected}\"", capture.Body);
-    }
-
     [Fact]
     public async Task Start_uses_the_configured_worker_credentials_and_defaults()
     {
@@ -141,7 +125,7 @@ public class FlowableWorkflowClientTests
         var client = Client(capture.Responds(HttpStatusCode.InternalServerError));
 
         await Assert.ThrowsAsync<HttpRequestException>(
-            () => client.StartRegistrationProcessAsync(RegistrationId.New(), DiplomaOrigin.Binnenlands));
+            () => client.StartRegistrationProcessAsync(RegistrationId.New()));
     }
 
     [Fact]
@@ -151,7 +135,7 @@ public class FlowableWorkflowClientTests
         var client = Client(capture.Responds(HttpStatusCode.Created, "null"));
 
         var ex = await Assert.ThrowsAsync<InvalidOperationException>(
-            () => client.StartRegistrationProcessAsync(RegistrationId.New(), DiplomaOrigin.Binnenlands));
+            () => client.StartRegistrationProcessAsync(RegistrationId.New()));
         Assert.Contains("empty process-instance", ex.Message);
     }
 
@@ -258,61 +242,6 @@ public class FlowableWorkflowClientTests
         Assert.Contains($"\"value\":\"{expected}\"", capture.Body);
     }
 
-    [Fact]
-    public async Task Withdraw_process_correlates_the_message_to_the_subscribed_execution()
-    {
-        HttpRequestMessage? getReq = null;
-        HttpRequestMessage? putReq = null;
-        string? putBody = null;
-        var client = Client(new StubHandler(async req =>
-        {
-            if (req.Method == HttpMethod.Get)
-            {
-                getReq = req;
-                return new HttpResponseMessage(HttpStatusCode.OK)
-                {
-                    Content = new StringContent("""{"data":[{"id":"exec-9"}]}""", Encoding.UTF8, "application/json"),
-                };
-            }
-            putReq = req;
-            putBody = await req.Content!.ReadAsStringAsync();
-            return new HttpResponseMessage(HttpStatusCode.OK);
-        }));
-
-        await client.WithdrawProcessAsync("pi-1");
-
-        // 1. Find the execution subscribed to the withdrawal message for this instance.
-        Assert.Equal(HttpMethod.Get, getReq!.Method);
-        Assert.Contains("service/runtime/executions", getReq.RequestUri!.ToString());
-        Assert.Contains("messageEventSubscriptionName=RegistratieIngetrokken", getReq.RequestUri!.Query);
-        Assert.Contains("processInstanceId=pi-1", getReq.RequestUri!.Query);
-        // 2. Deliver messageEventReceived to that execution (PUT), tripping the interrupting event.
-        Assert.Equal(HttpMethod.Put, putReq!.Method);
-        Assert.Equal("http://flowable/flowable-rest/service/runtime/executions/exec-9",
-            putReq.RequestUri!.ToString());
-        Assert.Contains("\"action\":\"messageEventReceived\"", putBody);
-        Assert.Contains("\"messageName\":\"RegistratieIngetrokken\"", putBody);
-    }
-
-    [Fact]
-    public async Task Withdraw_process_is_a_no_op_when_no_execution_is_subscribed()
-    {
-        var methods = new List<HttpMethod>();
-        var client = Client(new StubHandler(req =>
-        {
-            methods.Add(req.Method);
-            return Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
-            {
-                Content = new StringContent("""{"data":[]}""", Encoding.UTF8, "application/json"),
-            });
-        }));
-
-        await client.WithdrawProcessAsync("pi-1");
-
-        // No subscribed execution → no message delivered (best-effort), no throw.
-        Assert.DoesNotContain(HttpMethod.Put, methods);
-    }
-
     [Fact]
     public async Task Complete_beoordeling_throws_when_flowable_rejects_the_request()
     {
@@ -322,108 +251,4 @@ public class FlowableWorkflowClientTests
         await Assert.ThrowsAsync<HttpRequestException>(
             () => client.CompleteBeoordelingAsync("task-1", BeoordelingsBesluit.Goedkeuren));
     }
-
-    // ── S-14 (#15): 14-day beoordeling escalation → reassign to teamlead (ADR-0015) ───────────────
-    // The BPMN parks a parallel escalation token on a non-interrupting P14D boundary timer, surfaced as
-    // an external-worker job on the BeoordelingEscaleren topic. The worker reassigns the still-open
-    // Beoordelen task from the behandelaar group to teamlead, then completes the escalation job.
-
-    [Fact]
-    public async Task Acquire_escalation_jobs_posts_the_escalation_topic_and_parses_the_process_instance()
-    {
-        var capture = new RequestCapture();
-        var client = Client(capture.Responds(HttpStatusCode.OK,
-            """[{"id":"job-9","processInstanceId":"pi-1"}]"""));
-
-        var jobs = await client.AcquireBeoordelingEscalatieJobsAsync(3);
-
-        var job = Assert.Single(jobs);
-        Assert.Equal("job-9", job.JobId);
-        Assert.Equal("pi-1", job.ProcessInstanceId);
-        Assert.Equal("http://flowable/flowable-rest/external-job-api/acquire/jobs",
-            capture.Seen!.RequestUri!.ToString());
-        Assert.Contains("\"topic\":\"BeoordelingEscaleren\"", capture.Body);
-        Assert.Contains("\"numberOfTasks\":3", capture.Body);
-        Assert.Contains("\"workerId\":\"worker-x\"", capture.Body);
-    }
-
-    [Theory]
-    [InlineData("[]")]
-    [InlineData("null")]
-    public async Task Acquire_escalation_jobs_returns_empty_when_none_are_parked(string body)
-    {
-        var capture = new RequestCapture();
-        var client = Client(capture.Responds(HttpStatusCode.OK, body));
-
-        Assert.Empty(await client.AcquireBeoordelingEscalatieJobsAsync(1));
-        Assert.NotNull(capture.Seen);
-    }
-
-    [Fact]
-    public async Task Reassign_moves_the_open_beoordelen_task_from_behandelaar_to_teamlead()
-    {
-        var requests = new List<(HttpMethod Method, string Url, string? Body)>();
-        var client = Client(new StubHandler(async req =>
-        {
-            requests.Add((req.Method, req.RequestUri!.ToString(),
-                req.Content is null ? null : await req.Content.ReadAsStringAsync()));
-            // The task query returns the still-open Beoordelen task parked in this instance.
-            return req.RequestUri!.AbsoluteUri.EndsWith("service/query/tasks")
-                ? new HttpResponseMessage(HttpStatusCode.OK)
-                {
-                    Content = new StringContent("""{"data":[{"id":"task-7"}],"total":1}""",
-                        Encoding.UTF8, "application/json"),
-                }
-                : new HttpResponseMessage(HttpStatusCode.OK);
-        }));
-
-        await client.ReassignBeoordelingToTeamleadAsync("pi-1");
-
-        // 1. Find the still-open Beoordelen task in this process instance.
-        var query = requests.Single(r => r.Url.EndsWith("service/query/tasks"));
-        Assert.Equal(HttpMethod.Post, query.Method);
-        Assert.Contains("\"processInstanceId\":\"pi-1\"", query.Body);
-        Assert.Contains("\"taskDefinitionKey\":\"Beoordelen\"", query.Body);
-        // 2. Add teamlead as a candidate group on that task.
-        var add = requests.Single(r => r.Method == HttpMethod.Post
-            && r.Url.EndsWith("service/runtime/tasks/task-7/identitylinks"));
-        Assert.Contains("\"group\":\"teamlead\"", add.Body);
-        Assert.Contains("\"type\":\"candidate\"", add.Body);
-        // 3. Remove behandelaar as a candidate group — the task now belongs to teamlead.
-        Assert.Contains(requests, r => r.Method == HttpMethod.Delete
-            && r.Url.EndsWith("service/runtime/tasks/task-7/identitylinks/groups/behandelaar/candidate"));
-    }
-
-    [Fact]
-    public async Task Reassign_is_a_no_op_when_the_beoordelen_task_is_no_longer_open()
-    {
-        // The behandelaar completed it just before the timer fired: nothing to reassign, no throw.
-        var methods = new List<HttpMethod>();
-        var client = Client(new StubHandler(req =>
-        {
-            methods.Add(req.Method);
-            return Task.FromResult(new HttpResponseMessage(HttpStatusCode.OK)
-            {
-                Content = new StringContent("""{"data":[],"total":0}""", Encoding.UTF8, "application/json"),
-            });
-        }));
-
-        await client.ReassignBeoordelingToTeamleadAsync("pi-1");
-
-        Assert.DoesNotContain(HttpMethod.Delete, methods);
-    }
-
-    [Fact]
-    public async Task Complete_escalation_job_posts_to_the_job_complete_endpoint()
-    {
-        var capture = new RequestCapture();
-        var client = Client(capture.Responds(HttpStatusCode.NoContent));
-
-        await client.CompleteBeoordelingEscalatieJobAsync("job-9");
-
-        Assert.Equal(HttpMethod.Post, capture.Seen!.Method);
-        Assert.Equal("http://flowable/flowable-rest/external-job-api/acquire/jobs/job-9/complete",
-            capture.Seen.RequestUri!.ToString());
-        Assert.Contains("\"workerId\":\"worker-x\"", capture.Body);
-    }
 }

services/domain/Big.Tests/RegistrationTests.cs

@@ -16,15 +16,6 @@ public class RegistrationTests
         Assert.Null(registration.ProcessInstanceId);
     }
 
-    [Fact]
-    public void A_registration_defaults_to_a_domestic_diploma()
-        => Assert.Equal(DiplomaOrigin.Binnenlands, Registration.Submit("123456782").DiplomaOrigin);
-
-    [Fact]
-    public void A_foreign_diploma_submission_records_its_origin()
-        => Assert.Equal(DiplomaOrigin.Buitenlands,
-            Registration.Submit("123456782", DiplomaOrigin.Buitenlands).DiplomaOrigin);
-
     [Theory]
     [InlineData("")]
     [InlineData("   ")]
@@ -226,72 +217,4 @@ public class RegistrationTests
         Assert.Contains("Afgewezen", rejectEx.Message);
         Assert.Equal(RegistrationStatus.Afgewezen, registration.Status);
     }
-
-    [Fact]
-    public void Withdrawing_an_ingediend_registration_sets_it_ingetrokken()
-    {
-        var registration = Registration.Submit("123456782");
-
-        registration.Withdraw();
-
-        Assert.Equal(RegistrationStatus.Ingetrokken, registration.Status);
-    }
-
-    [Fact]
-    public void Withdrawing_an_in_behandeling_registration_sets_it_ingetrokken()
-    {
-        // A citizen can still pull a registration back while a behandelaar has it in behandeling.
-        var registration = Registration.Submit("123456782");
-        registration.TakeIntoBehandeling();
-
-        registration.Withdraw();
-
-        Assert.Equal(RegistrationStatus.Ingetrokken, registration.Status);
-    }
-
-    [Fact]
-    public void Withdrawing_needs_no_zaak()
-    {
-        // Withdrawal is the citizen's own action and does not depend on the zaak having been opened.
-        var registration = Registration.Submit("123456782");
-
-        registration.Withdraw();
-
-        Assert.Equal(RegistrationStatus.Ingetrokken, registration.Status);
-        Assert.Null(registration.ZaakUrl);
-    }
-
-    [Fact]
-    public void Re_withdrawing_an_already_ingetrokken_registration_is_idempotent()
-    {
-        var registration = Registration.Submit("123456782");
-        registration.Withdraw();
-
-        registration.Withdraw();
-
-        Assert.Equal(RegistrationStatus.Ingetrokken, registration.Status);
-    }
-
-    [Fact]
-    public void Withdrawing_an_approved_registration_is_rejected()
-    {
-        var registration = Registration.Submit("123456782");
-        registration.AttachZaak(new Uri("http://openzaak/zaken/api/v1/zaken/abc"));
-        registration.Approve();
-
-        var ex = Assert.Throws<InvalidOperationException>(() => registration.Withdraw());
-        Assert.Contains("only an INGEDIEND", ex.Message);
-        Assert.Equal(RegistrationStatus.Ingeschreven, registration.Status);
-    }
-
-    [Fact]
-    public void Withdrawing_a_rejected_registration_is_rejected()
-    {
-        var registration = Registration.Submit("123456782");
-        registration.Reject();
-
-        var ex = Assert.Throws<InvalidOperationException>(() => registration.Withdraw());
-        Assert.Contains("only an INGEDIEND", ex.Message);
-        Assert.Equal(RegistrationStatus.Afgewezen, registration.Status);
-    }
 }

services/domain/Big.Tests/SubmitRegistrationTests.cs

@@ -25,19 +25,6 @@ public class SubmitRegistrationTests
         Assert.Equal(2, store.SaveCount);
     }
 
-    [Fact]
-    public async Task Submitting_a_foreign_diploma_carries_its_origin_to_the_process()
-    {
-        var store = new FakeRegistrationStore();
-        var workflow = new FakeWorkflowClient();
-        var handler = new SubmitRegistration(store, workflow);
-
-        var id = await handler.HandleAsync(new SubmitRegistrationCommand("123456782", DiplomaOrigin.Buitenlands));
-
-        Assert.Equal(DiplomaOrigin.Buitenlands, (await store.GetAsync(id))!.DiplomaOrigin);
-        Assert.Equal(DiplomaOrigin.Buitenlands, workflow.StartedWithOrigin);
-    }
-
     [Fact]
     public async Task Rejects_a_null_command_without_touching_the_store_or_workflow()
     {

services/domain/Big.Tests/WerkbakTests.cs

@@ -46,19 +46,4 @@ public class WerkbakTests
 
         Assert.Empty(await werkbak.GetAsync());
     }
-
-    [Fact]
-    public async Task Skips_a_task_whose_registration_is_no_longer_open()
-    {
-        // A withdrawn registration (S-11) may still have a Beoordelen task lingering until the workflow
-        // cancels it; the werkbak lists only registrations still open for beoordeling, so it drops off.
-        var store = new FakeRegistrationStore();
-        var registration = Registration.Submit("123456782");
-        registration.Withdraw();
-        store.Seed(registration);
-        var tasks = new FakeUserTaskClient([new BeoordelingTask("task-1", registration.Id)]);
-        var werkbak = new Werkbak(tasks, store);
-
-        Assert.Empty(await werkbak.GetAsync());
-    }
 }

services/domain/Big.Tests/WithdrawRegistrationTests.cs

@@ -1,123 +0,0 @@
-using Big.Application;
-using Big.Domain;
-
-namespace Big.Tests;
-
-public class WithdrawRegistrationTests
-{
-    private const string Bsn = "123456782";
-
-    private static Registration Submitted(string processInstanceId = "proc-1")
-    {
-        var registration = Registration.Submit(Bsn);
-        registration.RecordProcessStarted(processInstanceId);
-        return registration;
-    }
-
-    private static WithdrawRegistrationCommand Command(RegistrationId id, string bsn = Bsn) => new(id, bsn);
-
-    [Fact]
-    public async Task Withdrawing_marks_the_registration_ingetrokken_and_persists_it()
-    {
-        var store = new FakeRegistrationStore();
-        var registration = Submitted();
-        store.Seed(registration);
-        var handler = new WithdrawRegistration(store, new FakeWorkflowClient());
-
-        var outcome = await handler.HandleAsync(Command(registration.Id));
-
-        Assert.Equal(WithdrawOutcome.Withdrawn, outcome);
-        var saved = await store.GetAsync(registration.Id);
-        Assert.Equal(RegistrationStatus.Ingetrokken, saved!.Status);
-        Assert.Equal(1, store.SaveCount);
-    }
-
-    [Fact]
-    public async Task Withdrawing_cancels_the_running_process()
-    {
-        var store = new FakeRegistrationStore();
-        var registration = Submitted("proc-42");
-        store.Seed(registration);
-        var workflow = new FakeWorkflowClient();
-        var handler = new WithdrawRegistration(store, workflow);
-
-        await handler.HandleAsync(Command(registration.Id));
-
-        // The process the registration recorded at submit is cancelled (ADR-0014).
-        Assert.Equal("proc-42", workflow.WithdrawnProcessInstanceId);
-    }
-
-    [Fact]
-    public async Task Withdrawing_before_a_process_was_started_still_marks_ingetrokken()
-    {
-        var store = new FakeRegistrationStore();
-        var registration = Registration.Submit(Bsn); // no RecordProcessStarted
-        store.Seed(registration);
-        var workflow = new FakeWorkflowClient();
-        var handler = new WithdrawRegistration(store, workflow);
-
-        await handler.HandleAsync(Command(registration.Id));
-
-        Assert.Equal(RegistrationStatus.Ingetrokken, (await store.GetAsync(registration.Id))!.Status);
-        Assert.Null(workflow.WithdrawnProcessInstanceId);
-    }
-
-    [Fact]
-    public async Task A_different_bsn_cannot_withdraw_the_registration()
-    {
-        // Owner-scoping: only the zorgprofessional who submitted may withdraw. Another bsn is told
-        // NotFound (we don't reveal the registration exists) and nothing is changed.
-        var store = new FakeRegistrationStore();
-        var registration = Submitted();
-        store.Seed(registration);
-        var workflow = new FakeWorkflowClient();
-        var handler = new WithdrawRegistration(store, workflow);
-
-        var outcome = await handler.HandleAsync(Command(registration.Id, bsn: "999999990"));
-
-        Assert.Equal(WithdrawOutcome.NotFound, outcome);
-        Assert.Equal(RegistrationStatus.Ingediend, (await store.GetAsync(registration.Id))!.Status);
-        Assert.Equal(0, store.SaveCount);
-        Assert.Null(workflow.WithdrawnProcessInstanceId);
-    }
-
-    [Fact]
-    public async Task Rejects_a_null_command_without_touching_the_store()
-    {
-        var store = new FakeRegistrationStore();
-        var handler = new WithdrawRegistration(store, new FakeWorkflowClient());
-
-        await Assert.ThrowsAsync<ArgumentNullException>(() => handler.HandleAsync(null!));
-        Assert.Equal(0, store.SaveCount);
-    }
-
-    [Fact]
-    public async Task Withdrawing_an_unknown_registration_is_not_found()
-    {
-        var store = new FakeRegistrationStore();
-        var handler = new WithdrawRegistration(store, new FakeWorkflowClient());
-
-        var outcome = await handler.HandleAsync(Command(RegistrationId.New()));
-
-        Assert.Equal(WithdrawOutcome.NotFound, outcome);
-        Assert.Equal(0, store.SaveCount);
-    }
-
-    [Fact]
-    public async Task Re_withdrawing_an_already_ingetrokken_registration_is_idempotent()
-    {
-        var store = new FakeRegistrationStore();
-        var registration = Submitted();
-        store.Seed(registration);
-        var workflow = new FakeWorkflowClient();
-        var handler = new WithdrawRegistration(store, workflow);
-
-        await handler.HandleAsync(Command(registration.Id));
-        var second = await handler.HandleAsync(Command(registration.Id));
-
-        // The second withdrawal is a no-op: still Withdrawn, but the aggregate is not persisted again.
-        Assert.Equal(WithdrawOutcome.Withdrawn, second);
-        Assert.Equal(1, store.SaveCount);
-        Assert.Equal(RegistrationStatus.Ingetrokken, (await store.GetAsync(registration.Id))!.Status);
-    }
-}

services/domain/stryker-config.json

@@ -4,8 +4,7 @@
     "test-projects": ["Big.Tests/Big.Tests.csproj"],
     "reporters": ["progress", "html"],
     "mutate": [
-      "!**/OpenZaakJobPump.cs",
-      "!**/BeoordelingEscalatiePump.cs"
+      "!**/OpenZaakJobPump.cs"
     ],
     "thresholds": {
       "high": 95,

tests/acceptance/Acceptance.csproj

@@ -22,9 +22,6 @@
     <ProjectReference Include="..\..\services\acl\Acl.Infrastructure\Acl.Infrastructure.csproj" />
     <ProjectReference Include="..\..\services\event-subscriber\EventSubscriber.Application\EventSubscriber.Application.csproj" />
     <ProjectReference Include="..\..\services\domain\Big.Application\Big.Application.csproj" />
-    <!-- The beoordeling-escalation scenario drives the escalation worker (Infrastructure), as the
-         ACL scenario drives Acl.Infrastructure — escalation has no domain-aggregate surface (S-14). -->
-    <ProjectReference Include="..\..\services\domain\Big.Infrastructure\Big.Infrastructure.csproj" />
     <ProjectReference Include="..\..\services\bff\Bff.Api\Bff.Api.csproj" />
   </ItemGroup>
 

tests/acceptance/Features/EenBeoordelingEscaleren.feature

@@ -1,22 +0,0 @@
-# language: en
-# Drives S-14 (#15). A beoordeling a behandelaar does not pick up within 14 days escalates to the
-# teamlead: a non-interrupting boundary timer parks a BeoordelingEscaleren job (ADR-0015) which the
-# escalation worker drains, reassigning the still-open Beoordelen task's candidate group to teamlead.
-# A beoordeling completed before the timer fires does not escalate. This scenario exercises the
-# escalation worker against an in-memory Flowable stand-in; the timer firing live is verify-domain.
-Feature: Een beoordeling escaleren
-  Als teamleider wil ik dat een beoordeling die na 14 dagen niet is opgepakt naar mij escaleert
-  zodat aanvragen niet blijven liggen.
-
-  Scenario: Na 14 dagen zonder oppakken escaleert de beoordeling naar de teamlead
-    Given a registration parked at the Beoordelen task for the behandelaar
-    When the 14-day escalation timer fires
-    And the escalation worker runs
-    Then the beoordeling is reassigned to the teamlead
-
-  Scenario: Een tijdig afgeronde beoordeling escaleert niet
-    Given a registration parked at the Beoordelen task for the behandelaar
-    When the behandelaar completes the beoordeling before the timer fires
-    And the 14-day escalation timer fires
-    And the escalation worker runs
-    Then the beoordeling stays with the behandelaar

tests/acceptance/Features/EenDiplomaRouteren.feature

@@ -1,19 +0,0 @@
-# language: en
-# Drives S-13 (#14). A registration's diploma origin decides its route: a domestic (Binnenlands)
-# diploma goes straight to beoordeling, a foreign (Buitenlands) one is routed through an extra
-# CBGV-advies step (PRD flow 4). The decision itself is a DMN evaluated inside the workflow
-# (ADR-0016); the domain's part — verified here — is carrying the origin into the process so the DMN
-# can route on it. The DMN evaluation and the CBGV routing are verified live (verify-domain).
-Feature: Een diploma op herkomst routeren
-  Als register wil ik een aanvraag met een buitenlands diploma extra laten toetsen
-  zodat een CBGV-advies wordt ingewonnen voordat een behandelaar beoordeelt.
-
-  Scenario: Een binnenlands diploma start de registratie als binnenlands
-    Given a zorgprofessional with a "Binnenlands" diploma
-    When they submit their registration
-    Then the registratie process is started carrying a "Binnenlands" diploma
-
-  Scenario: Een buitenlands diploma start de registratie als buitenlands
-    Given a zorgprofessional with a "Buitenlands" diploma
-    When they submit their registration
-    Then the registratie process is started carrying a "Buitenlands" diploma

tests/acceptance/Features/EenRegistratieIntrekken.feature

@@ -1,22 +0,0 @@
-# language: en
-# Drives S-11 (#12). A zorgprofessional withdraws their own submitted registration ("trek aanvraag
-# in"): it advances to INGETROKKEN and its running workflow is cancelled (ADR-0014). Only the owner
-# may withdraw — another bsn is told not-found. Exercised against in-memory stand-ins for the store
-# and the Workflow Client; the live Flowable message correlation is verified by the domain check.
-Feature: Een registratie intrekken
-  Als zorgprofessional wil ik mijn ingediende registratie kunnen intrekken
-  zodat een aanvraag die ik niet meer wil niet in behandeling blijft.
-
-  Scenario: De zorgprofessional trekt zijn eigen registratie in
-    Given a submitted registration with a running process
-    When the zorgprofessional withdraws it
-    Then the withdrawal succeeds
-    And the registration has status "INGETROKKEN"
-    And the running process is cancelled
-
-  Scenario: Een andere zorgprofessional kan de registratie niet intrekken
-    Given a submitted registration with a running process
-    When a different zorgprofessional tries to withdraw it
-    Then the withdrawal is reported not found
-    And the registration has status "INGEDIEND"
-    And the running process is not cancelled

tests/acceptance/Steps/EenBeoordelingEscalerenSteps.cs

@@ -1,44 +0,0 @@
-using Acceptance.Support;
-using Big.Infrastructure;
-using Microsoft.Extensions.Logging.Abstractions;
-using Reqnroll;
-using Xunit;
-
-namespace Acceptance.Steps;
-
-/// <summary>Bindings for <c>EenBeoordelingEscaleren.feature</c> (S-14). Drives the escalation worker
-/// (<see cref="BeoordelingEscalatieProcessor"/>) against an in-memory Flowable stand-in; one instance
-/// per scenario. Escalation has no domain-aggregate surface — it only reassigns who may claim the
-/// still-open Beoordelen task — so the scenario asserts on the task's candidate group.</summary>
-[Binding]
-[Scope(Feature = "Een beoordeling escaleren")]
-public sealed class EenBeoordelingEscalerenSteps
-{
-    private readonly InMemoryEscalatieClient _flowable = new();
-    private string _processInstanceId = "";
-
-    [Given("a registration parked at the Beoordelen task for the behandelaar")]
-    public void GivenARegistrationParkedForTheBehandelaar()
-        => _processInstanceId = _flowable.ParkBeoordeling();
-
-    [When("the 14-day escalation timer fires")]
-    public void WhenTheEscalationTimerFires()
-        => _flowable.FireEscalationTimer(_processInstanceId);
-
-    [When("the behandelaar completes the beoordeling before the timer fires")]
-    public void WhenTheBehandelaarCompletesBeforeTheTimer()
-        => _flowable.CompleteBeoordeling(_processInstanceId);
-
-    [When("the escalation worker runs")]
-    public async Task WhenTheEscalationWorkerRuns()
-        => await new BeoordelingEscalatieProcessor(
-            _flowable, NullLogger<BeoordelingEscalatieProcessor>.Instance).PumpOnceAsync(5);
-
-    [Then("the beoordeling is reassigned to the teamlead")]
-    public void ThenTheBeoordelingIsReassignedToTheTeamlead()
-        => Assert.Equal("teamlead", _flowable.CandidateGroupFor(_processInstanceId));
-
-    [Then("the beoordeling stays with the behandelaar")]
-    public void ThenTheBeoordelingStaysWithTheBehandelaar()
-        => Assert.Equal("behandelaar", _flowable.CandidateGroupFor(_processInstanceId));
-}

tests/acceptance/Steps/EenDiplomaRouterenSteps.cs

@@ -1,36 +0,0 @@
-using Acceptance.Support;
-using Big.Application;
-using Big.Domain;
-using Reqnroll;
-using Xunit;
-
-namespace Acceptance.Steps;
-
-/// <summary>Bindings for <c>EenDiplomaRouteren.feature</c> (S-13). Drives the submit use case against
-/// in-memory ports and asserts the registratie process is started carrying the diploma origin — the
-/// domain's contribution to flow 4. The DMN evaluation and the foreign→CBGV-advies routing it drives
-/// are verified live (verify-domain); one instance per scenario.</summary>
-[Binding]
-[Scope(Feature = "Een diploma op herkomst routeren")]
-public sealed class EenDiplomaRouterenSteps
-{
-    private readonly InMemoryRegistrationStore _store = new();
-    private readonly InMemoryWorkflowClient _workflow = new();
-    private DiplomaOrigin _origin;
-
-    [Given("a zorgprofessional with a \"(.*)\" diploma")]
-    public void GivenAZorgprofessionalWithADiploma(string origin)
-        => _origin = Enum.Parse<DiplomaOrigin>(origin, ignoreCase: true);
-
-    [When("they submit their registration")]
-    public async Task WhenTheySubmitTheirRegistration()
-        => await new SubmitRegistration(_store, _workflow).HandleAsync(
-            new SubmitRegistrationCommand("123456782", _origin));
-
-    [Then("the registratie process is started carrying a \"(.*)\" diploma")]
-    public void ThenTheProcessIsStartedCarryingTheDiploma(string expected)
-    {
-        Assert.NotNull(_workflow.StartedFor);
-        Assert.Equal(Enum.Parse<DiplomaOrigin>(expected, ignoreCase: true), _workflow.StartedWithOrigin);
-    }
-}

tests/acceptance/Steps/EenRegistratieIntrekkenSteps.cs

@@ -1,59 +0,0 @@
-using Acceptance.Support;
-using Big.Application;
-using Big.Domain;
-using Reqnroll;
-using Xunit;
-
-namespace Acceptance.Steps;
-
-/// <summary>Bindings for <c>EenRegistratieIntrekken.feature</c> (S-11). Submits a registration (which
-/// records its process) and then applies the WithdrawRegistration use case against in-memory ports;
-/// one instance per scenario. Scoped to this feature so its "the registration has status" step does
-/// not clash with the identically phrased steps in the other features.</summary>
-[Binding]
-[Scope(Feature = "Een registratie intrekken")]
-public sealed class EenRegistratieIntrekkenSteps
-{
-    private const string OwnerBsn = "123456782";
-
-    private readonly InMemoryRegistrationStore _store = new();
-    private readonly InMemoryWorkflowClient _workflow = new();
-    private RegistrationId _id;
-    private WithdrawOutcome _outcome;
-
-    [Given("a submitted registration with a running process")]
-    public async Task GivenASubmittedRegistrationWithARunningProcess()
-        => _id = await new SubmitRegistration(_store, _workflow).HandleAsync(new SubmitRegistrationCommand(OwnerBsn));
-
-    [When("the zorgprofessional withdraws it")]
-    public async Task WhenTheZorgprofessionalWithdrawsIt()
-        => _outcome = await new WithdrawRegistration(_store, _workflow).HandleAsync(
-            new WithdrawRegistrationCommand(_id, OwnerBsn));
-
-    [When("a different zorgprofessional tries to withdraw it")]
-    public async Task WhenADifferentZorgprofessionalTriesToWithdrawIt()
-        => _outcome = await new WithdrawRegistration(_store, _workflow).HandleAsync(
-            new WithdrawRegistrationCommand(_id, "999999990"));
-
-    [Then("the withdrawal succeeds")]
-    public void ThenTheWithdrawalSucceeds() => Assert.Equal(WithdrawOutcome.Withdrawn, _outcome);
-
-    [Then("the withdrawal is reported not found")]
-    public void ThenTheWithdrawalIsReportedNotFound() => Assert.Equal(WithdrawOutcome.NotFound, _outcome);
-
-    [Then("the registration has status \"(.*)\"")]
-    public async Task ThenTheRegistrationHasStatus(string expected)
-    {
-        var registration = await _store.GetAsync(_id);
-        Assert.NotNull(registration);
-        Assert.Equal(expected, registration.Status.ToString().ToUpperInvariant());
-    }
-
-    [Then("the running process is cancelled")]
-    public void ThenTheRunningProcessIsCancelled()
-        => Assert.Equal(InMemoryWorkflowClient.StartedProcessInstanceId, _workflow.WithdrawnProcessInstanceId);
-
-    [Then("the running process is not cancelled")]
-    public void ThenTheRunningProcessIsNotCancelled()
-        => Assert.Null(_workflow.WithdrawnProcessInstanceId);
-}

tests/acceptance/Support/BffAcceptanceHost.cs

@@ -69,9 +69,6 @@ public sealed class CapturingDomainClient : IDomainClient
         return Task.FromResult(new SubmitAccepted("reg-acc-1", "Ingediend"));
     }
 
-    public Task<bool> WithdrawRegistrationAsync(string registrationId, string bsn, CancellationToken ct = default)
-        => Task.FromResult(true);
-
     public Task<IReadOnlyList<WerkbakItem>> GetWerkbakAsync(CancellationToken ct = default)
         => Task.FromResult<IReadOnlyList<WerkbakItem>>([]);
 

tests/acceptance/Support/InMemoryDomainPorts.cs

@@ -1,6 +1,5 @@
 using Big.Application;
 using Big.Domain;
-using Big.Infrastructure;
 
 namespace Acceptance.Support;
 
@@ -12,22 +11,12 @@ public sealed class InMemoryWorkflowClient : IWorkflowClient
     public const string StartedProcessInstanceId = "proc-acc-1";
 
     public RegistrationId? StartedFor { get; private set; }
-    public DiplomaOrigin? StartedWithOrigin { get; private set; }
-    public string? WithdrawnProcessInstanceId { get; private set; }
 
-    public Task<string> StartRegistrationProcessAsync(
-        RegistrationId registrationId, DiplomaOrigin diplomaOrigin, CancellationToken ct = default)
+    public Task<string> StartRegistrationProcessAsync(RegistrationId registrationId, CancellationToken ct = default)
     {
         StartedFor = registrationId;
-        StartedWithOrigin = diplomaOrigin;
         return Task.FromResult(StartedProcessInstanceId);
     }
-
-    public Task WithdrawProcessAsync(string processInstanceId, CancellationToken ct = default)
-    {
-        WithdrawnProcessInstanceId = processInstanceId;
-        return Task.CompletedTask;
-    }
 }
 
 /// <summary>An in-memory ACL stand-in: records the bsn it opened a zaak for and returns a fixed URL,
@@ -77,59 +66,6 @@ public sealed class InMemoryUserTaskClient : IUserTaskClient
     }
 }
 
-/// <summary>An in-memory Flowable stand-in for the beoordeling-escalation scenario (S-14): it models
-/// one Beoordelen task per process instance — its candidate group and whether it is still open — and
-/// the escalation jobs the non-interrupting 14-day boundary timer parks. It drives the escalation
-/// worker's behaviour without a running Flowable; the timer firing live is the verify-domain check.</summary>
-public sealed class InMemoryEscalatieClient : IBeoordelingEscalatieClient
-{
-    private sealed class ParkedTask
-    {
-        public string CandidateGroup { get; set; } = "behandelaar";
-        public bool IsOpen { get; set; } = true;
-    }
-
-    private readonly Dictionary<string, ParkedTask> _tasks = [];
-    private readonly List<EscalatieJob> _parked = [];
-    private int _seq;
-
-    /// <summary>A registration parks at Beoordelen, claimable by the behandelaar group.</summary>
-    public string ParkBeoordeling()
-    {
-        var pid = $"pi-{++_seq}";
-        _tasks[pid] = new ParkedTask();
-        return pid;
-    }
-
-    /// <summary>The behandelaar completes the beoordeling before the timer fires: the task closes.</summary>
-    public void CompleteBeoordeling(string processInstanceId) => _tasks[processInstanceId].IsOpen = false;
-
-    /// <summary>The 14-day boundary timer fires: a non-interrupting token parks an escalation job.</summary>
-    public void FireEscalationTimer(string processInstanceId)
-        => _parked.Add(new EscalatieJob($"job-{++_seq}", processInstanceId));
-
-    /// <summary>The candidate group that may currently pick the task up.</summary>
-    public string CandidateGroupFor(string processInstanceId) => _tasks[processInstanceId].CandidateGroup;
-
-    public Task<IReadOnlyList<EscalatieJob>> AcquireBeoordelingEscalatieJobsAsync(int maxJobs, CancellationToken ct = default)
-        => Task.FromResult<IReadOnlyList<EscalatieJob>>(_parked.Take(maxJobs).ToList());
-
-    public Task ReassignBeoordelingToTeamleadAsync(string processInstanceId, CancellationToken ct = default)
-    {
-        // No-op if the behandelaar already completed it — the timer/completion race (§8.6).
-        var task = _tasks[processInstanceId];
-        if (task.IsOpen)
-            task.CandidateGroup = "teamlead";
-        return Task.CompletedTask;
-    }
-
-    public Task CompleteBeoordelingEscalatieJobAsync(string jobId, CancellationToken ct = default)
-    {
-        _parked.RemoveAll(j => j.JobId == jobId);
-        return Task.CompletedTask;
-    }
-}
-
 /// <summary>An in-memory registration store for the domain acceptance scenario.</summary>
 public sealed class InMemoryRegistrationStore : IRegistrationStore
 {

tests/e2e/playwright.config.ts

@@ -3,9 +3,6 @@ import { defineConfig, devices } from '@playwright/test';
 // The e2e runs inside the compose network (infra/run-e2e-check.sh); baseURL defaults to the
 // self-service service. Keep timeouts generous — the first navigation triggers the DigiD flow.
 const baseURL = process.env.SELF_SERVICE_URL ?? 'http://self-service';
-// The behandel portal is a second origin the happy path visits (staff approve from the werkbak);
-// it needs the same insecure-origin-as-secure treatment as self-service for the PKCE login (below).
-const behandelURL = process.env.BEHANDEL_URL ?? 'http://behandel';
 
 export default defineConfig({
   testDir: '.',
@@ -25,9 +22,7 @@ export default defineConfig({
     // the production HTTPS context. This flag is only honoured by the full Chromium build (new
     // headless), not Playwright's default headless-shell, so pin `channel: 'chromium'`.
     channel: 'chromium',
-    launchOptions: {
-      args: [`--unsafely-treat-insecure-origin-as-secure=${baseURL},${behandelURL}`],
-    },
+    launchOptions: { args: [`--unsafely-treat-insecure-origin-as-secure=${baseURL}`] },
   },
   projects: [{ name: 'chromium', use: { ...devices['Desktop Chrome'] } }],
 });

tests/e2e/registration.spec.ts

@@ -1,11 +1,10 @@
 import { expect, test } from '@playwright/test';
 
-// Walking-skeleton happy path (S-08d + S-09 + S-09b + S-12): a zorgprofessional logs in via mock
-// DigiD and submits through the self-service portal → BFF → domain; the entry appears in the openbaar
-// register as INGEDIEND; a behandelaar then logs in to the behandel portal, finds the registration in
-// the werkbak, and approves it (goedkeuren); the decision completes the Flowable Beoordelen task and
-// flows via the ACL → NRC → event-subscriber → projection, and the openbaar register shows INGESCHREVEN.
-test('DigiD submit → public INGEDIEND → behandelaar goedkeurt → public INGESCHREVEN', async ({ page }) => {
+// Walking-skeleton happy path (S-08d + S-09 + S-09b): a zorgprofessional logs in via mock DigiD and
+// submits through the self-service portal → BFF → domain; the entry appears in the openbaar register
+// as INGEDIEND; a behandelaar approves it via the temporary admin endpoint; the approval flows via the
+// ACL → NRC → event-subscriber → projection, and the openbaar register then shows it as INGESCHREVEN.
+test('DigiD login → submit → public INGEDIEND → approve → public INGESCHREVEN', async ({ page, request }) => {
   // Visiting the guarded page redirects to the Keycloak (mock DigiD) login.
   await page.goto('/');
 
@@ -44,42 +43,21 @@ test('DigiD submit → public INGEDIEND → behandelaar goedkeurt → public ING
   await expect(page.getByRole('row', { name: reference }).getByRole('cell', { name: 'INGEDIEND' }))
     .toBeVisible();
 
-  // A behandelaar picks the registration up in the behandel-portal werkbak and approves it
-  // (goedkeuren) — the S-12 flow that replaces the temporary admin endpoint. Navigating here switches
-  // to the medewerker realm (a different Keycloak realm than the citizen's digid session).
-  await page.goto('http://behandel/');
-  await page.locator('#username').fill('merel-behandelaar');
-  await page.locator('#password').fill('test123');
-  await page.locator('#kc-login').click();
-
-  await expect(page.getByRole('heading', { name: /Werkbak/i })).toBeVisible();
-
-  // The registration parks at the Beoordelen user task only after the worker has opened its zaak, so
-  // it appears in the werkbak asynchronously — reload until this reference's row shows up. Target the
-  // decide button by reference (not a generic "Goedkeuren"): the shared verify stack holds other open
-  // tasks, so a positional match could act on someone else's registration.
-  const goedkeuren = page.getByRole('button', { name: `Goedkeuren ${reference}` });
+  // Approve via the temporary admin endpoint (reached directly on the compose network, as a
+  // behandelaar would until the behandel-portal exists — S-12). The zaak is opened off the request
+  // path by the worker, so wait for it before approving.
   await expect
     .poll(async () => {
-      await page.reload();
-      return goedkeuren.count();
+      const res = await request.get(`http://domain:8080/registrations/${reference}`);
+      return res.ok() ? (await res.json()).zaakUrl : null;
     }, { timeout: 30_000, intervals: [1_000, 2_000, 3_000, 5_000] })
-    .toBeGreaterThan(0);
+    .toBeTruthy();
 
-  // Click and wait for the decide POST to finish (204) BEFORE leaving the page. `click()` only
-  // dispatches the request; navigating away immediately cancels it in flight (nginx logs a 499) and
-  // the decision never reaches the domain — so the registration would stay INGEDIEND.
-  const decided = page.waitForResponse(
-    (r) =>
-      r.url().includes(`/behandel/registrations/${reference}/decide`) &&
-      r.request().method() === 'POST',
-  );
-  await goedkeuren.click();
-  expect((await decided).status()).toBe(204);
+  const approve = await request.post(`http://domain:8080/registrations/${reference}/approve`);
+  expect(approve.status()).toBe(204);
 
-  // The approval flows back to the projection; back on the openbaar register *our* row (matched by
-  // its reference) now shows INGESCHREVEN.
-  await page.goto('http://openbaar/');
+  // The approval flows back to the projection; the openbaar register now shows *our* row (matched by
+  // its reference) as INGESCHREVEN.
   await expect
     .poll(async () => {
       await page.reload();

tests/e2e/withdrawal.spec.ts

@@ -1,27 +0,0 @@
-import { expect, test } from '@playwright/test';
-
-// S-11 (Flow 3): a zorgprofessional logs in via mock DigiD, submits a registration, then withdraws
-// it ("trek aanvraag in") from the self-service portal. The withdrawal goes portal → BFF (owner-
-// scoped by the DigiD token's bsn) → domain, which cancels the running workflow (ADR-0014); the page
-// then confirms the registration is ingetrokken.
-test('DigiD submit → trek aanvraag in → self-service confirms ingetrokken', async ({ page }) => {
-  // Visiting the guarded page redirects to the Keycloak (mock DigiD) login.
-  await page.goto('/');
-
-  await page.locator('#username').fill('jan-burger');
-  await page.locator('#password').fill('test123');
-  await page.locator('#kc-login').click();
-
-  await expect(page.getByRole('heading', { name: /Zelfservice/i })).toBeVisible();
-
-  await page.getByRole('button', { name: /indienen/i }).click();
-
-  // The BFF accepted it and the page shows the confirmation with the reference.
-  await expect(page.getByText(/ontvangen/i)).toBeVisible();
-
-  // Withdraw it. The confirmation of withdrawal appears only after the decide POST completes (204),
-  // so awaiting the "ingetrokken" text also proves the request landed — no premature navigation.
-  await page.getByRole('button', { name: /trek aanvraag in/i }).click();
-
-  await expect(page.getByText(/is ingetrokken/i)).toBeVisible();
-});

workflows/diploma-eligibility.dmn

@@ -1,38 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!-- Diploma-eligibility decision (S-13, ADR-0016). Evaluated inline by the registratie process as a
-     BPMN businessRuleTask: given the diploma's origin, it sets the `route` the process should take.
-     A foreign (Buitenlands) diploma routes through the extra CBGV-advies assessment step; a domestic
-     one (or anything else) goes DIRECT to beoordeling. FIRST hit policy: the foreign rule wins, and
-     the empty-input catch-all is the default. -->
-<definitions xmlns="https://www.omg.org/spec/DMN/20191111/MODEL/"
-             xmlns:flowable="http://flowable.org/dmn"
-             id="diplomaEligibilityDefinitions"
-             name="Diploma eligibility"
-             namespace="http://respellion.nl/big/dmn">
-  <decision id="diploma-eligibility" name="Diploma eligibility">
-    <decisionTable id="dt-diploma-eligibility" hitPolicy="FIRST">
-      <input id="in-origin" label="Diploma origin">
-        <inputExpression id="ie-origin" typeRef="string">
-          <text>diplomaOrigin</text>
-        </inputExpression>
-      </input>
-      <output id="out-route" label="Route" name="route" typeRef="string"/>
-      <rule id="rule-foreign">
-        <inputEntry id="rule-foreign-in">
-          <text>"Buitenlands"</text>
-        </inputEntry>
-        <outputEntry id="rule-foreign-out">
-          <text>"CBGV_ADVIES"</text>
-        </outputEntry>
-      </rule>
-      <rule id="rule-default">
-        <inputEntry id="rule-default-in">
-          <text></text>
-        </inputEntry>
-        <outputEntry id="rule-default-out">
-          <text>"DIRECT"</text>
-        </outputEntry>
-      </rule>
-    </decisionTable>
-  </decision>
-</definitions>

workflows/registratie.bpmn

@@ -1,7 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <definitions xmlns="http://www.omg.org/spec/BPMN/20100524/MODEL"
              xmlns:flowable="http://flowable.org/bpmn"
-             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
              xmlns:bpmndi="http://www.omg.org/spec/BPMN/20100524/DI"
              xmlns:omgdc="http://www.omg.org/spec/DD/20100524/DC"
              xmlns:omgdi="http://www.omg.org/spec/DD/20100524/DI"
@@ -12,22 +11,7 @@
        S-03 added the external task (Workflow Client / ACL). S-12 adds the behandelaar's beoordeling
        as a user task: the process parks here until a behandelaar claims and completes it with a
        `besluit` (goedkeuren/afwijzen). The registrationId set at start rides along as a process
-       variable so the werkbak can correlate each task back to its aggregate.
-       S-11 adds withdrawal: while parked at Beoordelen the citizen can trek de aanvraag in — an
-       interrupting message boundary event (RegistratieIngetrokken) cancels the task and ends the
-       process via a dedicated "ingetrokken" end (ADR-0014). The Workflow Client delivers the message
-       to the task's execution; the BPMN owns the cancellation path.
-       S-14 adds escalation: a NON-interrupting boundary timer (P14D) on Beoordelen. If a behandelaar
-       has not picked the task up within 14 days it fires a parallel token to an external-worker task
-       (BeoordelingEscaleren); the Workflow Client reassigns the still-open Beoordelen task from the
-       behandelaar group to teamlead (ADR-0015). The Beoordelen task stays open throughout — the timer
-       only changes who may claim it.
-       S-13 adds diploma-eligibility routing: between OpenZaakAanmaken and Beoordelen a DMN
-       businessRuleTask evaluates the `diploma-eligibility` decision on the diplomaOrigin start
-       variable; an exclusive gateway routes a foreign diploma through the CBGV-advies user task
-       before Beoordelen, a domestic one straight there (ADR-0016). -->
-  <message id="Message_Ingetrokken" name="RegistratieIngetrokken"/>
-
+       variable so the werkbak can correlate each task back to its aggregate. -->
   <process id="registratie" name="Registratie ontvangen" isExecutable="true">
 
     <startEvent id="start" name="Registratie ontvangen"/>
@@ -38,70 +22,13 @@
                  flowable:type="external-worker"
                  flowable:topic="OpenZaakAanmaken"/>
 
-    <sequenceFlow id="flow2" sourceRef="OpenZaakAanmaken" targetRef="DiplomaEligibiliteit"/>
-
-    <!-- S-13: evaluate the diploma-eligibility DMN inline (ADR-0016). Flowable runs the deployed
-         `diploma-eligibility` decision against the diplomaOrigin start variable and sets the `route`
-         output as a process variable. The gateway then routes a foreign diploma through CBGV-advies,
-         a domestic one straight to Beoordelen. -->
-    <businessRuleTask id="DiplomaEligibiliteit" name="Diploma-eligibiliteit bepalen" flowable:type="dmn">
-      <extensionElements>
-        <flowable:field name="decisionTableReferenceKey">
-          <flowable:string><![CDATA[diploma-eligibility]]></flowable:string>
-        </flowable:field>
-      </extensionElements>
-    </businessRuleTask>
-
-    <sequenceFlow id="flow2a" sourceRef="DiplomaEligibiliteit" targetRef="RouteOpDiploma"/>
-
-    <exclusiveGateway id="RouteOpDiploma" name="Buitenlands diploma?" default="flowDirect"/>
-
-    <sequenceFlow id="flowCbgv" sourceRef="RouteOpDiploma" targetRef="CBGVAdvies">
-      <conditionExpression xsi:type="tFormalExpression"><![CDATA[${route == 'CBGV_ADVIES'}]]></conditionExpression>
-    </sequenceFlow>
-
-    <!-- The extra CBGV-style assessment for foreign diplomas (PRD flow 4). A CBGV medewerker
-         completes it, after which the case continues to the regular beoordeling. -->
-    <userTask id="CBGVAdvies" name="CBGV-advies" flowable:candidateGroups="cbgv"/>
-
-    <sequenceFlow id="flowCbgvNaarBeoordelen" sourceRef="CBGVAdvies" targetRef="Beoordelen"/>
-
-    <sequenceFlow id="flowDirect" sourceRef="RouteOpDiploma" targetRef="Beoordelen"/>
+    <sequenceFlow id="flow2" sourceRef="OpenZaakAanmaken" targetRef="Beoordelen"/>
 
     <userTask id="Beoordelen" name="Beoordelen" flowable:candidateGroups="behandelaar"/>
 
     <sequenceFlow id="flow3" sourceRef="Beoordelen" targetRef="end"/>
 
     <endEvent id="end" name="Registratie beoordeeld"/>
-
-    <!-- Withdrawal (S-11): interrupting message boundary event on Beoordelen. On RegistratieIngetrokken
-         the task is cancelled and the process ends as "ingetrokken". -->
-    <boundaryEvent id="Ingetrokken" attachedToRef="Beoordelen" cancelActivity="true">
-      <messageEventDefinition messageRef="Message_Ingetrokken"/>
-    </boundaryEvent>
-
-    <sequenceFlow id="flow4" sourceRef="Ingetrokken" targetRef="endIngetrokken"/>
-
-    <endEvent id="endIngetrokken" name="Registratie ingetrokken"/>
-
-    <!-- Escalation (S-14): non-interrupting P14D boundary timer on Beoordelen. On timeout a parallel
-         token runs EscaleerBeoordeling, an external-worker task the Workflow Client picks up to
-         reassign the still-open Beoordelen task from behandelaar to teamlead (ADR-0015). -->
-    <boundaryEvent id="EscaleerTimer" attachedToRef="Beoordelen" cancelActivity="false">
-      <timerEventDefinition>
-        <timeDuration>P14D</timeDuration>
-      </timerEventDefinition>
-    </boundaryEvent>
-
-    <sequenceFlow id="flow5" sourceRef="EscaleerTimer" targetRef="EscaleerBeoordeling"/>
-
-    <serviceTask id="EscaleerBeoordeling" name="Beoordeling escaleren"
-                 flowable:type="external-worker"
-                 flowable:topic="BeoordelingEscaleren"/>
-
-    <sequenceFlow id="flow6" sourceRef="EscaleerBeoordeling" targetRef="endEscaleren"/>
-
-    <endEvent id="endEscaleren" name="Beoordeling geëscaleerd"/>
   </process>
 
   <bpmndi:BPMNDiagram id="diagram">
@@ -110,79 +37,25 @@
         <omgdc:Bounds x="100" y="100" width="30" height="30"/>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="s_task" bpmnElement="OpenZaakAanmaken">
-        <omgdc:Bounds x="180" y="85" width="120" height="60"/>
-      </bpmndi:BPMNShape>
-      <bpmndi:BPMNShape id="s_dmn" bpmnElement="DiplomaEligibiliteit">
-        <omgdc:Bounds x="350" y="85" width="120" height="60"/>
-      </bpmndi:BPMNShape>
-      <bpmndi:BPMNShape id="s_route" bpmnElement="RouteOpDiploma" isMarkerVisible="true">
-        <omgdc:Bounds x="520" y="90" width="40" height="40"/>
-      </bpmndi:BPMNShape>
-      <bpmndi:BPMNShape id="s_cbgv" bpmnElement="CBGVAdvies">
-        <omgdc:Bounds x="500" y="200" width="120" height="60"/>
+        <omgdc:Bounds x="200" y="85" width="120" height="60"/>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="s_beoordelen" bpmnElement="Beoordelen">
-        <omgdc:Bounds x="630" y="85" width="120" height="60"/>
+        <omgdc:Bounds x="390" y="85" width="120" height="60"/>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNShape id="s_end" bpmnElement="end">
-        <omgdc:Bounds x="810" y="100" width="30" height="30"/>
-      </bpmndi:BPMNShape>
-      <bpmndi:BPMNShape id="s_ingetrokken" bpmnElement="Ingetrokken">
-        <omgdc:Bounds x="690" y="135" width="30" height="30"/>
-      </bpmndi:BPMNShape>
-      <bpmndi:BPMNShape id="s_endIngetrokken" bpmnElement="endIngetrokken">
-        <omgdc:Bounds x="690" y="250" width="30" height="30"/>
-      </bpmndi:BPMNShape>
-      <bpmndi:BPMNShape id="s_escaleerTimer" bpmnElement="EscaleerTimer">
-        <omgdc:Bounds x="700" y="70" width="30" height="30"/>
-      </bpmndi:BPMNShape>
-      <bpmndi:BPMNShape id="s_escaleerBeoordeling" bpmnElement="EscaleerBeoordeling">
-        <omgdc:Bounds x="800" y="20" width="120" height="60"/>
-      </bpmndi:BPMNShape>
-      <bpmndi:BPMNShape id="s_endEscaleren" bpmnElement="endEscaleren">
-        <omgdc:Bounds x="970" y="35" width="30" height="30"/>
+        <omgdc:Bounds x="580" y="100" width="30" height="30"/>
       </bpmndi:BPMNShape>
       <bpmndi:BPMNEdge id="e_flow1" bpmnElement="flow1">
         <omgdi:waypoint x="130" y="115"/>
-        <omgdi:waypoint x="180" y="115"/>
+        <omgdi:waypoint x="200" y="115"/>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="e_flow2" bpmnElement="flow2">
-        <omgdi:waypoint x="300" y="115"/>
-        <omgdi:waypoint x="350" y="115"/>
-      </bpmndi:BPMNEdge>
-      <bpmndi:BPMNEdge id="e_flow2a" bpmnElement="flow2a">
-        <omgdi:waypoint x="470" y="115"/>
-        <omgdi:waypoint x="520" y="110"/>
-      </bpmndi:BPMNEdge>
-      <bpmndi:BPMNEdge id="e_flowDirect" bpmnElement="flowDirect">
-        <omgdi:waypoint x="560" y="110"/>
-        <omgdi:waypoint x="630" y="115"/>
-      </bpmndi:BPMNEdge>
-      <bpmndi:BPMNEdge id="e_flowCbgv" bpmnElement="flowCbgv">
-        <omgdi:waypoint x="540" y="130"/>
-        <omgdi:waypoint x="540" y="200"/>
-      </bpmndi:BPMNEdge>
-      <bpmndi:BPMNEdge id="e_flowCbgvNaarBeoordelen" bpmnElement="flowCbgvNaarBeoordelen">
-        <omgdi:waypoint x="620" y="230"/>
-        <omgdi:waypoint x="660" y="230"/>
-        <omgdi:waypoint x="660" y="145"/>
+        <omgdi:waypoint x="320" y="115"/>
+        <omgdi:waypoint x="390" y="115"/>
       </bpmndi:BPMNEdge>
       <bpmndi:BPMNEdge id="e_flow3" bpmnElement="flow3">
-        <omgdi:waypoint x="750" y="115"/>
-        <omgdi:waypoint x="810" y="115"/>
-      </bpmndi:BPMNEdge>
-      <bpmndi:BPMNEdge id="e_flow4" bpmnElement="flow4">
-        <omgdi:waypoint x="705" y="165"/>
-        <omgdi:waypoint x="705" y="250"/>
-      </bpmndi:BPMNEdge>
-      <bpmndi:BPMNEdge id="e_flow5" bpmnElement="flow5">
-        <omgdi:waypoint x="715" y="70"/>
-        <omgdi:waypoint x="715" y="50"/>
-        <omgdi:waypoint x="800" y="50"/>
-      </bpmndi:BPMNEdge>
-      <bpmndi:BPMNEdge id="e_flow6" bpmnElement="flow6">
-        <omgdi:waypoint x="920" y="50"/>
-        <omgdi:waypoint x="970" y="50"/>
+        <omgdi:waypoint x="510" y="115"/>
+        <omgdi:waypoint x="580" y="115"/>
       </bpmndi:BPMNEdge>
     </bpmndi:BPMNPlane>
   </bpmndi:BPMNDiagram>